—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2023.0118
Microsoft Patch Tuesday update for Microsoft Windows for July 2023
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Windows
Windows Admin Center
Windows Server
Raw Image Extension
VP9 Video Extensions
Operating System: Windows
Resolution: Patch/Upgrade
CVE Names: CVE-2023-36884 CVE-2023-36874 CVE-2023-36872
CVE-2023-36871 CVE-2023-35367 CVE-2023-35366
CVE-2023-35365 CVE-2023-35364 CVE-2023-35363
CVE-2023-35362 CVE-2023-35361 CVE-2023-35360
CVE-2023-35358 CVE-2023-35357 CVE-2023-35356
CVE-2023-35353 CVE-2023-35352 CVE-2023-35351
CVE-2023-35350 CVE-2023-35348 CVE-2023-35347
CVE-2023-35346 CVE-2023-35345 CVE-2023-35344
CVE-2023-35343 CVE-2023-35342 CVE-2023-35341
CVE-2023-35340 CVE-2023-35339 CVE-2023-35338
CVE-2023-35337 CVE-2023-35336 CVE-2023-35332
CVE-2023-35331 CVE-2023-35330 CVE-2023-35329
CVE-2023-35328 CVE-2023-35326 CVE-2023-35325
CVE-2023-35324 CVE-2023-35323 CVE-2023-35322
CVE-2023-35321 CVE-2023-35320 CVE-2023-35319
CVE-2023-35318 CVE-2023-35317 CVE-2023-35316
CVE-2023-35315 CVE-2023-35314 CVE-2023-35313
CVE-2023-35312 CVE-2023-35310 CVE-2023-35309
CVE-2023-35308 CVE-2023-35306 CVE-2023-35305
CVE-2023-35304 CVE-2023-35303 CVE-2023-35302
CVE-2023-35300 CVE-2023-35299 CVE-2023-35298
CVE-2023-35297 CVE-2023-35296 CVE-2023-33174
CVE-2023-33173 CVE-2023-33172 CVE-2023-33169
CVE-2023-33168 CVE-2023-33167 CVE-2023-33166
CVE-2023-33164 CVE-2023-33163 CVE-2023-33155
CVE-2023-33154 CVE-2023-32085 CVE-2023-32084
CVE-2023-32083 CVE-2023-32057 CVE-2023-32056
CVE-2023-32055 CVE-2023-32054 CVE-2023-32053
CVE-2023-32051 CVE-2023-32049 CVE-2023-32046
CVE-2023-32045 CVE-2023-32044 CVE-2023-32043
CVE-2023-32042 CVE-2023-32041 CVE-2023-32040
CVE-2023-32039 CVE-2023-32038 CVE-2023-32037
CVE-2023-32035 CVE-2023-32034 CVE-2023-32033
CVE-2023-29347 CVE-2023-21756 CVE-2023-21526
Comment: CVSS (Max): 9.8* CVE-2023-32057 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Microsoft
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* Not all CVSS available when published
OVERVIEW
Microsoft has released its monthly security patch update for the
month of July 2023.
This update resolves 104 vulnerabilities across the following
product(s): [1]
Raw Image Extension
VP9 Video Extensions
Windows 10
Windows 11
Windows 11 version 21H2
Windows Admin Center
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows Server 2019
Windows Server 2022
IMPACT
Microsoft has given the following details regarding these vulnerabilities.
Details Impact Severity
ADV230001 Defense in Depth None
ADV230002 Security Feature Bypass Important
CVE-2023-21526 Information Disclosure Important
CVE-2023-21756 Elevation of Privilege Important
CVE-2023-29347 Spoofing Important
CVE-2023-32033 Remote Code Execution Important
CVE-2023-32034 Denial of Service Important
CVE-2023-32035 Denial of Service Important
CVE-2023-32037 Information Disclosure Important
CVE-2023-32038 Remote Code Execution Important
CVE-2023-32039 Information Disclosure Important
CVE-2023-32040 Information Disclosure Important
CVE-2023-32041 Information Disclosure Important
CVE-2023-32042 Information Disclosure Important
CVE-2023-32043 Security Feature Bypass Important
CVE-2023-32044 Denial of Service Important
CVE-2023-32045 Denial of Service Important
CVE-2023-32046 Elevation of Privilege Important
CVE-2023-32049 Security Feature Bypass Important
CVE-2023-32051 Remote Code Execution Important
CVE-2023-32053 Elevation of Privilege Important
CVE-2023-32054 Elevation of Privilege Important
CVE-2023-32055 Elevation of Privilege Important
CVE-2023-32056 Elevation of Privilege Important
CVE-2023-32057 Remote Code Execution Critical
CVE-2023-32083 Information Disclosure Important
CVE-2023-32084 Denial of Service Important
CVE-2023-32085 Information Disclosure Important
CVE-2023-33154 Elevation of Privilege Important
CVE-2023-33155 Elevation of Privilege Important
CVE-2023-33163 Remote Code Execution Important
CVE-2023-33164 Denial of Service Important
CVE-2023-33166 Denial of Service Important
CVE-2023-33167 Denial of Service Important
CVE-2023-33168 Denial of Service Important
CVE-2023-33169 Denial of Service Important
CVE-2023-33172 Denial of Service Important
CVE-2023-33173 Denial of Service Important
CVE-2023-33174 Information Disclosure Important
CVE-2023-35296 Information Disclosure Important
CVE-2023-35297 Remote Code Execution Critical
CVE-2023-35298 Denial of Service Important
CVE-2023-35299 Elevation of Privilege Important
CVE-2023-35300 Remote Code Execution Important
CVE-2023-35302 Remote Code Execution Important
CVE-2023-35303 Remote Code Execution Important
CVE-2023-35304 Elevation of Privilege Important
CVE-2023-35305 Elevation of Privilege Important
CVE-2023-35306 Information Disclosure Important
CVE-2023-35308 Security Feature Bypass Important
CVE-2023-35309 Remote Code Execution Important
CVE-2023-35310 Remote Code Execution Important
CVE-2023-35312 Elevation of Privilege Important
CVE-2023-35313 Remote Code Execution Important
CVE-2023-35314 Denial of Service Important
CVE-2023-35315 Remote Code Execution Critical
CVE-2023-35316 Information Disclosure Important
CVE-2023-35317 Elevation of Privilege Important
CVE-2023-35318 Denial of Service Important
CVE-2023-35319 Denial of Service Important
CVE-2023-35320 Elevation of Privilege Important
CVE-2023-35321 Denial of Service Important
CVE-2023-35322 Remote Code Execution Important
CVE-2023-35323 Remote Code Execution Important
CVE-2023-35324 Information Disclosure Important
CVE-2023-35325 Information Disclosure Important
CVE-2023-35326 Information Disclosure Important
CVE-2023-35328 Elevation of Privilege Important
CVE-2023-35329 Denial of Service Important
CVE-2023-35330 Denial of Service Important
CVE-2023-35331 Denial of Service Important
CVE-2023-35332 Security Feature Bypass Important
CVE-2023-35336 Security Feature Bypass Important
CVE-2023-35337 Elevation of Privilege Important
CVE-2023-35338 Denial of Service Important
CVE-2023-35339 Denial of Service Important
CVE-2023-35340 Elevation of Privilege Important
CVE-2023-35341 Information Disclosure Important
CVE-2023-35342 Elevation of Privilege Important
CVE-2023-35343 Remote Code Execution Important
CVE-2023-35344 Remote Code Execution Important
CVE-2023-35345 Remote Code Execution Important
CVE-2023-35346 Remote Code Execution Important
CVE-2023-35347 Elevation of Privilege Important
CVE-2023-35348 Security Feature Bypass Important
CVE-2023-35350 Remote Code Execution Important
CVE-2023-35351 Remote Code Execution Important
CVE-2023-35352 Security Feature Bypass Critical
CVE-2023-35353 Elevation of Privilege Important
CVE-2023-35356 Elevation of Privilege Important
CVE-2023-35357 Elevation of Privilege Important
CVE-2023-35358 Elevation of Privilege Important
CVE-2023-35360 Elevation of Privilege Important
CVE-2023-35361 Elevation of Privilege Important
CVE-2023-35362 Elevation of Privilege Important
CVE-2023-35363 Elevation of Privilege Important
CVE-2023-35364 Elevation of Privilege Important
CVE-2023-35365 Remote Code Execution Critical
CVE-2023-35366 Remote Code Execution Critical
CVE-2023-35367 Remote Code Execution Critical
CVE-2023-36871 Security Feature Bypass Important
CVE-2023-36872 Information Disclosure Important
CVE-2023-36874 Elevation of Privilege Important
CVE-2023-36884 Remote Code Execution Important
MITIGATION
Microsoft recommends updating the software with the version made
available on the Microsoft Update Catalogue for the following
Knowledge Base articles. [1].
KB5028166, KB5028167, KB5028168, KB5028169, KB5028171
KB5028182, KB5028185, KB5028186, KB5028223, KB5028228
KB5028232, KB5028233
REFERENCES
[1] Microsoft Security Update Guidance
https://portal.msrc.microsoft.com/en-us/security-guidance
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation’s site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4TlMkNZI30y1K9AQhKbg/+NyCjeFsRW6GYSOPx9eK9xETSs6sHihOC
/mSYnIj1AQsbXfAdc323IB8heLYLQcYhtIllNecH0QgoKG7s8VsjcVjJy0KqmDd+
fEn6JDJVGobryHLK0ggYtGKMaqigMMjrqfJvXlb480nvu/voW6QD05DFQaBya7hK
a53dpVpMj+yusZse4T7N9jdqpDpnSFQlZvChNe1DEyP1Qb+q1ZYHCLFZi1l+gIT/
yaQ5g4mbZnWb42bC4jTHvWixx3VncVvEdTsEV1PdJcmcyAHMxFxQ11dsat4jc9ra
4/FXj8VoS03loLGEeXr7bbR5rj+52WYQ4fV/Ged3+5CwVzMXnIDAIXB5Pm5bnYdO
onz94l9RYob5lLf3GHdXWl+i2ctDRE3eoDWA7gaJCPTQPnf64uHbsejRhoQBjd+U
5GTx5aQGTpQljRzF16bbw19PMIDh61Ol3bFdUL3AtSzr7HP2bgmVY/NcFZJTQ4/x
oGOhoaaxsLuMtiDaRwdCStT7rScGkX1sMx68xeN9Q6+UFV9PH53GL6je7QD+RaUv
5quoYf00VlAZnQx+pNQLQ8vRkT1WbqAErBfpcOo448/wdtZup+lFt8rWegYyI8/4
s//QnNvAQYGbkZgPQ+Dv8Nk+zVGw7gDyQa7fyt+95x8Hh4DrUTMI9gyzc8pacQer
8o8LiVYI4do=
=NPI6
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins