Patchday January

‍The year starts with some interesting CVEs. We have summarised the most important ones for you.

Microsoft

For January, Microsoft released patches for a total of 83 CVEs covering Microsoft Windows, Edge (EdgeHTML-based), ChakraCore, Office, Microsoft Office Services and Web Apps, Visual Studio, Microsoft Malware Protection Engine, .NET Core, Asp .NET and Azure.

Of these CVEs, 10 are categorised as critical and 73 as important in terms of severity.

The patches and updates provided by Microsoft can be found in the Security Update Guide. Here you will also find further information and guidelines.

According to Microsoft, one bug is publicly known and one bug is known to be actively exploited at the time of release.

Max Mustermann

Source: Microsoft

The critical malware vulnerability in Microsoft Defender:

CVE-2021-1647 Microsoft Defender Remote Code Execution Vulnerability

The Microsoft Malware Protection Engine is automatically updated as needed, so it is possible that this bug is already patched on your system. If your systems are not connected to the internet, you will need to apply the patch manually. Microsoft does not specify how widespread the active attacks are, but there is a possibility that this vulnerability could be related to the recent reports of compromised Microsoft networks.

The CVEs listed under Critical:

CVE-2021-1665 GDI+ Remote Code Execution Vulnerability
CVE-2021-1643 HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2021-1668 Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability
CVE-2021-1705 Microsoft Edge (HTML-based) Memory Corruption Vulnerability
CVE-2021-1658 Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2021-1660 Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2021-1666 Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2021-1667 Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2021-1673 Remote Procedure Call Runtime Remote Code Execution Vulnerability

A gap classified as important should also receive attention:

CVE-2021-1648 Microsoft splwow64 Elevation of Privilege Vulnerability

This CVE is publicly known and attacks could occur soon, as the previous CVE has already been exploited by attackers. The starting point was a patch that checks strings and triggers a memory error. This makes it possible for attackers to gain higher user rights.

Further helpful information on the CVEs listed here and throughout the entire list can be found at Zero Day Initiative on a monthly basis.

Adobe

This month, Adobe has released 7 updates. They fix CVEs in Adobe Campaign Classic, Photoshop, Illustrator, Animate, InCopy, Captivate and Bridge. This fixes three vulnerabilities categorised as critical in uncontrolled search path elements for Illustrator, Animate and InCopy. However, none of the fixed vulnerabilities are listed as publicly known or under active attack at the time of update release.

SAP

SAP released 10 security advisories, as well as 7 updates to previously released Patchday security advisories.

5 security advisories classified as Hot News concern the following products:

SAP Business Client
SAP Business Warehouse
SAP BW4HANA
SAP NetWeaver AS JAVA

A security vulnerability has been classified as high for SAP NetWeaver AS ABAP.

The following graphic provides information on the distribution of vulnerability types in January 2021:

Source: SAP

‍

Stay safe and sound until the next Patchday on 9 February!