Jeff Goldman

Microsoft has announced a relatively light Patch Tuesday to end the year. The company’s announcement covers a total of 34 flaws, four of them critical. Still, Immersive Labs senior threat director Kev Breen told eSecurity Planet by email that the low number of vulnerabilities shouldn’t suggest any lack of urgency or importance.

Microsoft’s Patch Tuesday for October 2023 covers a total of 103 CVEs, including three zero-day vulnerabilities affecting WordPad, Skype and the HTTP/2 “Rapid Reset” DDoS vulnerability.

Microsoft’s Patch Tuesday for September 2023 includes 59 vulnerabilities, five of them rated critical and two currently being exploited in the wild. The two vulnerabilities currently being exploited are CVE-2023-36761, an information disclosure flaw in Microsoft Word with a CVSS score of 6.2; and CVE-2023-36802, an elevation of privilege flaw in Microsoft Streaming Service with a CVSS score of 7.8 that could provide an attacker with system privileges.