Skip to content ↓ | Skip to navigation ↓

Tripwire’s October 2021 Patch Priority Index (PPI) brings together important vulnerabilities from Squid, Microsoft, and Adobe.

First on the patch priority list this month are patches for Squid (CVE-2021-31807, CVE-2021-31806). Exploits for these vulnerabilities have been recently added to the Metasploit Exploit Framework. These systems should be patched as soon as possible.

Next are patches for Microsoft Office Word and Excel. These patches resolve 7 issues, including remote code execution and information disclosure vulnerabilities.

Up next are 4 patches for Adobe Reader and Acrobat that resolve arbitrary code execution and privilege escalation vulnerabilities.

Next are patches that affect components of the Windows operating systems. These patches resolve over 35 vulnerabilities, including elevation of privilege, information disclosure, security feature bypass, remote code execution, and remote code execution vulnerabilities. These vulnerabilities affect core Windows, print spooler, kernel, Fast FAT file system, bind filter, storage spaces, Windows Media, graphics, rich text edit, NAT, win32k, exFAT file system, text shaping, and others.

Lastly, administrators should focus on server-side patches for Microsoft SharePoint, Windows DNS, Active Directory, Hyper-V, Dynamics, and Exchange. These patches resolve numerous issues including spoofing, elevation of privilege, remote code execution, cross-site scripting, and denial of service vulnerabilities.

Exploit Framework – MetasploitCVE-2021-31807, CVE-2021-31806
Microsoft Office WordCVE-2021-40486
Microsoft Office ExcelCVE-2021-40472, CVE-2021-40479, CVE-2021-40474, CVE-2021-40473, CVE-2021-40471, CVE-2021-40485
APSB21-104: Adobe Reader and AcrobatCVE-2021-40728, CVE-2021-40729, CVE-2021-40730, CVE-2021-40731
Microsoft WindowsCVE-2021-38662, CVE-2021-41343, CVE-2021-40468, CVE-2021-40455, CVE-2021-40443, CVE-2021-40467, CVE-2021-40466, CVE-2021-40489, CVE-2021-40488, CVE-2021-41345, CVE-2021-40478, CVE-2021-26441, CVE-2021-40470, CVE-2021-41347, CVE-2021-41330, CVE-2021-41331, CVE-2021-40462, CVE-2021-40475, CVE-2021-41340, CVE-2021-40477, CVE-2021-41335, CVE-2021-41339, CVE-2021-40454, CVE-2021-40460, CVE-2021-40476, CVE-2021-41338, CVE-2021-41346, CVE-2021-41334, CVE-2021-40463, CVE-2021-41342, CVE-2021-26442, CVE-2021-40449, CVE-2021-41357, CVE-2021-40450, CVE-2021-36953, CVE-2021-40464, CVE-2021-41332, CVE-2021-36970, CVE-2021-38663, CVE-2021-40465
Active Directory Federation ServicesCVE-2021-41361, CVE-2021-41337
Role: Windows Hyper-VCVE-2021-40461
Role: Windows AD FS ServerCVE-2021-40456
Microsoft DynamicsCVE-2021-41354, CVE-2021-41353
Role: DNS ServerCVE-2021-40469
Microsoft Exchange ServerCVE-2021-34453, CVE-2021-41348, CVE-2021-26427, CVE-2021-41350
Microsoft Office SharePointCVE-2021-40482, CVE-2021-40487, CVE-2021-40483, CVE-2021-40484