Microsoft: Patch Tuesday brought not only a bunch of new cumulative updates for Windows 10, but also security fixes for at least 75 vulnerabilities, 15 of which are rated critical.
While this is considered a fairly light Patch Tuesday in terms of security vulnerabilities addressed, browsers and technologies that are in one way or another related to browsers (such as search engines) are the focus of updates this month.
Both Internet Explorer and Microsoft Edge dominate this patch cycle, as do other Windows components like ASP.NET Core and PowerShell Core.
There are updates for two published flaws for Microsoft Exchange Server (CVE-2018-0940) version 2010 to 2016 and ASP.NET Core 2.0 (CVE-2018-0808), but these vulnerabilities are rated as important, with no attacks recorded.
There are also new security updates for Windows 7 and Windows 8.1, which gain additional mitigations for Meltdown and Spectre. Microsoft is also expanding hardware patches to more chipsets, having previously shipped updates for Skylake processors.
There are two vulnerabilities that require a fix. CVE-2018-0886 describes a security flaw in the CredSSP authentication module that Microsoft says could be exploited by attackers with Remote Desktop. Additional fixes for this flaw will be released next month, with a new version of the RDP client.
Additionally, CVE-2018-0883 addresses a remote code execution flaw in the Windows Shell, which can be exploited when a user launches a malicious file.
Overall, system administrators have a lot of work to do this month, despite the relatively small number of critical updates found in Microsoft's browsers. System reboots are required, and just like every month, backups are recommended in case something goes wrong with a patch and a rollback is required.
