Tripwire Patch Priority Index for March 2023

Image

Tripwire's March 2023 Patch Priority Index (PPI) brings together important vulnerabilities for Google and Microsoft.

First on the patch priority list this month is a patch for Microsoft Office Outlook that resolves a critical elevation of privilege vulnerability (CVE-2023-23397) that should be patched as soon as possible. This vulnerability has seen exploitation in the wild and allows attackers to perform an NTLM Relay attack. Please refer to the following link for a detailed technical discussion for this issue (https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/).

Up next is a patch for Windows Defender that resolves an elevation of privilege vulnerability.

Next are patches for Microsoft Edge and Google Chromium that resolve over 20 vulnerabilities such as spoofing, type confusion, and use after free vulnerabilities.

Up next are 3 patches for Microsoft Office Excel that resolve remote code execution, spoofing, and denial of service vulnerabilities.

Next are patches that affect components of the core Windows operating system. These patches resolve over 55 vulnerabilities, including elevation of privilege, information disclosure, security feature bypass, remote code execution, and denial of service vulnerabilities. These vulnerabilities affect core Windows, Kernel, Graphics, PostScript and PCL6 drivers, ICP, TPM2.0, Media, Point-to-Point tunneling protocol, Secure Channel, RPC, and others.

Next are patches for Visual Studio Code that resolve remove code execution, elevation of privilege, and information disclosure vulnerabilities.

Lastly, administrators should focus on server-side patches for DNS Server, Hyper-V, Dynamics, and SharePoint. These patches resolve remote code execution, elevation of privilege, spoofing, cross-site scripting, and information disclosure vulnerabilities.