Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs

Immediately is Microsoft’s March 2024 Patch Tuesday, and security updates have been launched for 60 vulnerabilities, together with eighteen distant code execution flaws.

This Patch Tuesday fixes solely two important vulnerabilities: Hyper-V distant code execution and denial of service flaws.

The variety of bugs in every vulnerability class is listed under

• 24 Elevation of Privilege Vulnerabilities
• 3 Safety Characteristic Bypass Vulnerabilities
• 18 Distant Code Execution Vulnerabilities
• 6 Info Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

The entire depend of 60 flaws doesn’t embrace 4 Microsoft Edge flaws fastened on March seventh.

Moreover, Microsoft didn’t disclose any zero-days as a part of at the moment’s Patch Tuesday updates.

Flaws of curiosity

This month’s Patch Tuesday doesn’t repair any zero-day vulnerabilities however does embrace some attention-grabbing flaws, which now we have listed under.

CVE-2024-26199 – Microsoft Workplace Elevation of Privilege Vulnerability

Microsoft has fastened a Workplace vulnerability permitting any authenticated person to realize SYSTEM privileges.

“Any authenticated person might set off this vulnerability. It doesn’t require admin or different elevated privileges,” explains Microsoft.

The flaw was found by Iván Almuiña from Hacking Company Sàrl.

CVE-2024-20671 – Microsoft Defender Safety Characteristic Bypass Vulnerability

Microsoft has fastened a Microsoft Defender vulnerability that would 

“An authenticated attacker who efficiently exploited this vulnerability might stop Microsoft Defender from beginning,” explains Microsoft.

Nevertheless, this might be resolved by Home windows Defender Antimalware Platform updates which are mechanically put in on Home windows units.

This flaw is fastened in model 4.18.24010.12 of the Antimalware Platform.

Microsoft says that this flaw was found by Manuel Feifel with Infoguard (Vurex).

CVE-2024-21411 – Skype for Shopper Distant Code Execution Vulnerability

Microsoft has fastened a distant code execution vulnerability Skype for Shopper that may be triggered by a malicious hyperlink or picture.

“An attacker might exploit the vulnerability by sending the person a malicious hyperlink or a malicious picture by way of Instantaneous Message after which convincing the person to click on the hyperlink or picture,” explains Microsoft.

Microsoft says this flaw was found by Hector Peralta  and Nicole Armua working with Development Micro Zero Day Initiative.

Current updates from different corporations

Different distributors who launched updates or advisories in March 2024 embrace:

The March 2024 Patch Tuesday Safety Updates

Under is the whole checklist of resolved vulnerabilities within the March 2024 Patch Tuesday updates.

To entry the complete description of every vulnerability and the methods it impacts, you possibly can view the complete report right here.