Microsoft issued the July 2019 Security Updates on Tuesday that include 77 unique vulnerability fixes, 15 of those rated critical. In addition, two important bugs are also being exploited in the wild.
The updates address multiple Microsoft products to include:
- .NET Framework
- ASP.NET
- Azure
- Azure DevOps
- Edge
- Internet Explorer
- Microsoft Exchange Server
- Microsoft Office and Microsoft Office Services and Web Apps
- Microsoft Windows
- Open Source Software
- SQL Server
- Visual Studio
Microsoft has patched a number of vulnerabilities under active exploit or should be prioritized for patching by organizations.
Privilege Escalation attacks
Of special note, hackers have exploited in the wild two Privilege Escalation vulnerabilities (CVE-2019-0880 and CVE-2019-1132) that impact Windows splwow64 and Win32k components respectively. To add, the Win32K flaws also affect older Windows OS, such as Windows 7 and Server 2008 among others.
Users and organizations are also reminded that Microsoft ends support for Windows 7 and Server 2008 on January 14, 2020.
Also, 18 other Elevation of Privilege vulnerabilities were also patched.
Remote Code Execution issues
Microsoft also patched a critical Microsoft SQL Server Remote Code Execution (RCE) vulnerability CVE-2019-1068. The company said an attacker could exploit this vulnerability in order to execute code in the context of the SQL Server Database Engine service account.
Also, the company patched an RCE vulnerability CVE-2019-0785 in Microsoft’s DHCP Server when configured for failover. Consequently, an attacker with network access to the failover DHCP server could run arbitrary code.
Multiple critical Scripting Engine Memory Corruption vulnerabilities affect Microsoft Edge and Internet Explorer browsers. For example, those browser-related patches address CVE-2019-1001, CVE-2019-1004, CVE-2019-1056, CVE-2019-1103 and CVE-2019-1104 among others.
In all, 40 RCE-related issues (15 rated critical) were fixed in the July patch cycle.
Critical Patches
The 15 critical Microsoft vulnerabilities are listed below (each impacts Windows, Browser or Development Tools product families):
- CVE-2019-0785
- CVE-2019-1001
- CVE-2019-1004
- CVE-2019-1056
- CVE-2019-1059
- CVE-2019-1062
- CVE-2019-1063
- CVE-2019-1072
- CVE-2019-1092
- CVE-2019-1102
- CVE-2019-1103
- CVE-2019-1104
- CVE-2019-1106
- CVE-2019-1107
- CVE-2019-1113.
Of additional note, all of the above are remote code execution bugs.
Finally, check out Microsoft’s Security Update and July summary release notes for additional details on all patches.