Patchday December

Microsoft

Microsoft released 58 CVEs and advisories for Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Edge for Android, ChakraCore, Microsoft Office and Microsoft Office Services and Web Apps, Microsoft Exchange Server, Azure DevOps, Microsoft Dynamics, Visual Studio, Azure SDK and Azure Sphere.

Historically, according to the Zero Day Initiative, December 2020 is also a light month for patches. The total number of CVEs for 2020 is therefore 1,250

Max Mustermann

In the Security Update Guide, Microsoft provides all security updates. Of the 58 patches released in December, nine were categorised as critical and three as moderately serious.

The CVEs classified as Critical are:

CVE-2020-17131 Chakra Scripting Engine Memory Corruption Vulnerability
CVE-2020-17095 Hyper-V Remote Code Execution Vulnerability
CVE-2020-17152 Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
CVE-2020-17158 Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
CVE-2020-17117 Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17132 Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17142 Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17118 Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2020-17121 Microsoft SharePoint Remote Code Execution Vulnerability

The detailed list as well as helpful information about the CVEs is provided by Zero Day Initiative on a monthly basis.

Adobe

It has been known for three years now: Adobe will discontinue support for Flash Player on 31 December 2020. The lack of security has been a recurring theme here. To say goodbye, Adobe's release notes have a few nice words:

"We'd like to take this opportunity to thank all of our customers and developers who have used and created Flash Player content over the past two decades. We are proud that Flash has played a critical role in the development of web content across animation, interactivity, audio and video. We look forward to helping shape the next era of digital experiences.

Adobe will no longer support Flash Player after 31 December 2020. Adobe will no longer support Flash Player after 31 December 2020, and Adobe will block Flash content from running in Flash Player from 12 January 2021; Adobe strongly recommends that all users uninstall Flash Player immediately to protect their systems."

In addition to the latest Flash Player update, Adobe will release four security updates for Prelude, Lightroom and Experience Manager in December. The two vulnerabilities categorised as critical affect Lightroom and Prelude. In both, arbitrary code could be executed through an uncontrolled search element.

A vulnerability in Experience Manager was also classified as critical, as arbitrary JavaScript code could be executed in the browser. The second flaw, which could allow attackers to access sensitive information, has been categorised as high. Updates for Acrobat and Reader will also follow later this week.

SAP

SAP published 11 security advisories and 2 updates from previously published Patch Day security advisories.

Four vulnerabilities classified as Hot News affect the following products:

SAP NetWeaver AS JAVA (P2P Cluster Communication)
SAP BusinessObjects BI Platform (Crystal Report)
SAP Business Warehouse and SAP BW4HANA
SAP AS ABAP(DMIS) and SAP S4 HANA(DMIS)

Two vulnerabilities were classified as high for SAP Solution Manager (User Experience Monitoring), SAP NetWeaver AS ABAP (SAP Landscape Transformation - DMIS) and SAP S4 HANA (SAP Landscape Transformation).

The following graphic shows the distribution of vulnerability types in December 2020:

Source: SAP

‍

Stay safe and healthy until the next Patchday in the new year on 12 January!