Microsoft Patch Tuesday January 2024: Fixes 49 vulnerabilities

Microsoft released its first Patch Tuesday of the year (January 2024) yesterday, bringing fixes for 49 vulnerabilities . 12 of them allow remote code execution. Only two were classified as critical: one bypasses security features in Windows Kerberos and the other is in Hyper-V and allows remote code execution.

In the list below, you can see the types of vulnerabilities being fixed this month:

• 12 vulnerabilities that allow remote code execution
• 11 vulnerabilities that allow information disclosure
• 10 vulnerabilities that allow for escalation of privileges
• 7 vulnerabilities that allow bypassing security features
• 6 vulnerabilities that allow denial-of-service attacks
• 3 spoofing vulnerabilities

The total number of 49 flaws does not include 4 Microsoft Edge bugs that were fixed on January 5th.

See also: AI Engine: Vulnerability in WordPress plugin puts 50,000 sites at risk

Important vulnerabilities fixed in Microsoft Patch Tuesday January

It's worth noting that this month, no zero-day vulnerabilities were fixed, meaning vulnerabilities that were actively used in attacks or were publicly disclosed before the updates were released. However, some of the vulnerabilities are more important and interesting than others.

For example, Microsoft fixed a code execution vulnerability in Office Remote, tracked as CVE-2024-20677 , that allows threat actors to create malicious Office documents with embedded FBX 3D model files to execute code remotely

See also: Ivanti: Warns of critical vulnerability in EPM software

“A security vulnerability exists in FBX that could lead to remote code execution. To mitigate this vulnerability, the ability to import FBX files has been disabled in Word, Excel, PowerPoint, and Outlook for Windows and Mac,” Microsoft’s security bulletin explains.

“Versions of Office that had this feature enabled will no longer have access to it. This includes Office 2019, Office 2021, Office LTSC for Mac 2021, and Microsoft 365.“.

Additionally, a critical flaw in Windows Kerberos (CVE-2024-20674) was also fixed. It would have allowed an attacker to bypass the authentication feature.

See also: CISA warns of vulnerabilities in Chrome and Excel

Microsoft Patch Tuesday January 2024: All the vulnerabilities fixed

In the table below, you can see all the vulnerabilities that Microsoft is patching this month:

Microsoft Patch Tuesday is a practice followed by Microsoft, where on the second Tuesday of each month it releases updates and fixes for its operating systems , programs, and applications. These updates typically include security fixes, performance improvements, and new features.

The purpose of Microsoft Patch Tuesday is to provide Microsoft users with the best possible user experience by fixing issues and ensuring the security of their systems. Microsoft Patch Tuesday is important for several reasons. First, security updates help protect systems from security vulnerabilities and malware. These updates fix known security issues and strengthen the resilience of systems against attacks.

Source: www.bleepingcomputer.com