Microsoft released the April 2020 Security Updates that includes 113 unique vulnerability fixes, 18 of those rated critical. The updates also include patches for two Adobe Font Manager zero day vulnerabilities disclosed in March.
In all, the security updates address vulnerabilities in the following Microsoft products:
- ChakraCore
- Internet Explorer
- Microsoft Apps for Android
- Microsoft Apps for Mac
- Microsoft Dynamics
- Microsoft Edge (Chromium-based)
- Microsoft Edge (EdgeHTML-based)
- Microsoft Office and Microsoft Office Services and Web Apps
- Microsoft Windows
- Visual Studio
- Windows Defender
Microsoft has provided patches for each of the vulnerabilities and summarized in the April 2020 Security Updates Release Notes.
Adobe Font Manager Library zero-days patched
Microsoft patched two Adobe Font Manager Library zero day vulnerabilities (CVE-2020-0938 and CVE-2020-1020) under active attack in the wild and previously disclosed in a March advisory.
“For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft noted in each of the advisories.
Each of the vulnerabilities are rated Critical on older operating systems, such as Windows 7, Windows 8, Windows Server 2008, and Windows Server 2012.
The Adobe Font 1 vulnerabilities are rated Important when detected on Windows 10, Windows Server 2016 and Windows Server 2019.
Other Critical RCE vulnerabilities
An additional 16 Critical remote code execution (RCE) vulnerabilities were also fixed in this month’s security update.
One of the patches address a Windows Hyper-V RCE vulnerability CVE-2020-0910.
“A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code,” Microsoft stated in the advisory.
Microsoft also fixed four SharePoint RCE vulnerabilities (CVE-2020-0929, CVE-2020-0931, CVE-2020-0932 and CVE-2020-0974).
In each case, Microsoft said SharePoint software fails to check the source markup of an application package.
“An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account,” Microsoft added.
An additional 21 RCE bugs were fixed in multiple products, ranging from Important to Low severity.
Readers can also check out more vulnerability and patch details in Microsoft’s Security Update Guide.