Tripwire Patch Priority Index for November 2020

Image

Tripwire's November 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft, Adobe, and Oracle.

First on the patch priority list this month are three vulnerabilities in Oracle WebLogic Server that have recently been included within the Metasploit exploit framework. Supported versions of Oracle WebLogic Server that are affected include 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.

Up next on the patch priority list this month are patches for Microsoft Scripting Engine, Browser, and Microsoft Edge (Chromium-Based). These patches resolve 12 vulnerabilities that exist due to issues such as use after free, inappropriate implementation, insufficient policy enforcement, integer overflow, and memory corruption vulnerabilities.

Next on the list are patches for Microsoft Excel, Office, and Word, which resolve 7 vulnerabilities including remote code execution and security feature bypass.

Up next are patches for Adobe Reader and Acrobat that resolve 14 issues including heap-based buffer overflow, improper access control, improper input validation, security feature bypass, signature verification and validation bypass, out-of-bounds read and write, use-after-free, and race condition vulnerabilities.

Up next this month are patches that affect components of the Windows operating systems. These patches resolve more than 50 vulnerabilities, including denial of service, elevation of privilege, information disclosure, remote code execution, and memory corruption vulnerabilities. These vulnerabilities affect core Windows, GDI, Codecs Library, Remote Desktop, Kerberos, Error Reporting, Hyper-V, Network File System, Print Spooler, Remote Access, Defender, NDIS, Common Log File System Driver, and others.

Finally, administrators should focus on server-side patches for Microsoft, which resolve issues in Microsoft Dynamics, Microsoft Exchange, and Microsoft SharePoint. These patches resolve several issues, including cross-site scripting, information disclosure, spoofing, denial of service, and remote code execution vulnerabilities.