Microsoft Releases Patches for 64 Flaws — Two Under Active Attack

Microsoft today released its March 2019 software
updates^[1] to address a total of 64
CVE-listed security vulnerabilities in its Windows operating
systems and other products, 17 of which are rated critical, 45
important, one moderate and one low in severity.

The update addresses flaws in Windows, Internet Explorer, Edge,
MS Office, and MS Office SharePoint, ChakraCore, Skype for
Business, and Visual Studio NuGet.

Four of the security vulnerabilities, all rated important,
patched by the tech giant this month were disclosed publicly, of
which none were found exploited in the wild.

Microsoft Patches Two Zero-Day Flaws Under Active Attack

Microsoft has also patched two separate zero-day elevation of
privilege vulnerabilities in Windows.
Both flaws, also rated as important, reside in Win32k component
that hackers are actively exploiting in the wild, including the one
that Google warned of last week.

If you are unaware, Google last week released a critical
update for Chrome^[2]
web browser to address a high-severity flaw (CVE-2019-5786) that
attackers found exploiting in combination with a Windows
vulnerability (CVE-2019-0808^[3]).

Successful exploitation of both flaws together allowed remote
attackers to execute arbitrary code on targeted computers running
Windows 7 or Server 2018 and take full control of them.

The second zero-day elevation of privilege vulnerability in
Windows, assigned as CVE-2019-0797^[4], that’s also being
exploited in the wild is similar to the first one but affects
Windows 10, 8.1, Server 2012, 2016, and 2019.

This flaw was detected and reported to Microsoft by security
researchers Vasily Berdnikov and Boris Larin of Kaspersky Labs.

Update Also Patches 17 Critical and 45 Important Flaws

As expected, almost all of the listed critical-rated
vulnerabilities lead to remote code execution attacks and primarily
impact various versions of Windows 10 and Server editions. Most of
these flaws reside in Chakra Scripting Engine, VBScript Engine,
DHCP Client, and IE.

While some of the important-rated vulnerabilities also lead to
remote code execution attacks, others allow elevation of privilege,
information disclosure, and denial of service attacks.

Users and system administrators are strongly recommended to apply
the latest security patches as soon as possible to keep hackers and
cybercriminals away from taking control of their systems.

For installing the latest security patch updates, head on to
Settings → Update & Security → Windows Update → Check for updates,
on your computer system or you can install the updates
manually.

Windows 10 Now Automatically Uninstalls Updates That Cause
Problems

For addressing problematic update issues on Windows 10 devices,
Microsoft on Monday introduced a safety measure that automatically uninstalls buggy
software^[5] updates installed on
your system if your operating system detects a startup failure.

So after installing this month’s security update, if you receive
the following notification on your device, your Windows 10 computer
has been recovered from a startup failure, and the operating system
resolved the failure by uninstalling recently installed Windows
updates.

Adobe also rolled out security updates today to fix just two
critical arbitrary code execution vulnerabilities in Adobe Photoshop CC and
another in Adobe Digital Editions. Users of the affected Adobe
software for Windows and macOS are advised to update their software
packages to the latest versions.
^[6]