—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2023.0119.3
Microsoft Patch Tuesday update for Microsoft Office,
Microsoft Office Services and Web Apps for July 2023
12 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Microsoft 365 Apps
Microsoft Excel
Microsoft Office
Microsoft Outlook
Microsoft SharePoint
Microsoft Word
Operating System: Windows
macOS
Resolution: Patch/Upgrade
CVE Names: CVE-2023-36884 CVE-2023-35311 CVE-2023-33165
CVE-2023-33162 CVE-2023-33161 CVE-2023-33160
CVE-2023-33159 CVE-2023-33158 CVE-2023-33157
CVE-2023-33153 CVE-2023-33152 CVE-2023-33151
CVE-2023-33150 CVE-2023-33149 CVE-2023-33148
CVE-2023-33134
Comment: CVSS (Max): 9.6 CVE-2023-33150 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
CVSS Source: Microsoft
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Revision History: July 12 2023: Updated missing CVSS score in the Mail Subject
July 12 2023: CVSS information corrected
July 12 2023: Initial Release
OVERVIEW
Microsoft has released its monthly security patch update for the
month of July 2023.
This update resolves 16 vulnerabilities across the following
product(s): [1]
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions
Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Office 2019 for Mac
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office LTSC for Mac 2021
Microsoft Office Online Server
Microsoft Office for Universal
Microsoft Outlook 2013 (32-bit editions)
Microsoft Outlook 2013 (64-bit editions)
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Outlook 2016 (32-bit edition)
Microsoft Outlook 2016 (64-bit edition)
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)
IMPACT
Microsoft has given the following details regarding these vulnerabilities.
Details Impact Severity
CVE-2023-33134 Remote Code Execution Important
CVE-2023-33148 Elevation of Privilege Important
CVE-2023-33149 Remote Code Execution Important
CVE-2023-33150 Security Feature Bypass Important
CVE-2023-33151 Spoofing Important
CVE-2023-33152 Remote Code Execution Important
CVE-2023-33153 Remote Code Execution Important
CVE-2023-33157 Remote Code Execution Critical
CVE-2023-33158 Remote Code Execution Important
CVE-2023-33159 Spoofing Important
CVE-2023-33160 Remote Code Execution Critical
CVE-2023-33161 Remote Code Execution Important
CVE-2023-33162 Information Disclosure Important
CVE-2023-33165 Security Feature Bypass Important
CVE-2023-35311 Security Feature Bypass Important
CVE-2023-36884 Remote Code Execution Important
MITIGATION
Microsoft recommends updating the software with the version made
available on the Microsoft Update Catalogue for the following
Knowledge Base articles. [1].
KB4464506, KB4475581, KB4493154, KB5001952, KB5002058
KB5002069, KB5002400, KB5002406, KB5002411, KB5002419
KB5002421, KB5002423, KB5002424, KB5002425, KB5002426
KB5002427, KB5002432, KB5002434
REFERENCES
[1] Microsoft Security Update Guidance
https://portal.msrc.microsoft.com/en-us/security-guidance
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation’s site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK4bLMkNZI30y1K9AQjrQA/8DrSI5FPbM/sCZRq5UdjwaV/DECRtdIvP
dHJ5XH9FoB9h5P4nWlWDwI7Sl5J7Z1jec7pPxyavJUNvdeDz/Q0MYhSSk82iX/ly
Ro+GztyY884dPZfy2JVXbZmG4rDP31PR6MzSTe1fwRqTaTuEOn1KYJJfe3jcKFMc
9M/hstV5v7gRYV0fjzwJD/nTdiqjilSNpCzhvaA5AMM3PCO3C02paIFyNU/WodlV
ExcajINw/uXu/lH0r8F/9Jk5cT2TJn/k/a1zajtsRNZTWB7qC7RjmTWeBi50RNZk
6l4ptM6qNAqBMEPOnrZoo6ZKQnpBxpUM6jKIUnQKyjhK4Fg3BKPpuDU4PpX67slJ
lRBH22QpEhxqvPg84sVkP/lOfJqpemuRUBm7E0ShrGGiXbKViZFCtJlNxKycRRz3
waIxwv+lCMv5K7lTf8CII3WCFJU/CJ+232AWgk28W2uJ2XrScteH60s8/LvkBWTT
3pidz4O8pBdwhM6aMsYqRHYMB2HXeT1tWsy5M38xPrnJKucTpThn+DPcn2Vw1iFF
Ftlxlt0fgPDIWAOn5SvryU5KmNLtqBrJyqryJ8Fy/07ca4atFcpnp6wjTGN1NkJR
ZKm5l7m+hF1zNTl2xOAhwZGtwB/XRJVtZblLrI8njUylJ0EAqM2iLIf87ThIPyI0
W6aZrcdnfqY=
=l3nF
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins