Microsoft July 2019 Patch Tuesday fixes zero-day exploited by Russian hackers

Earlier today, Microsoft published its monthly roll-up of security updates known as Patch Tuesday. This month, the Redmond-based company patched 77 vulnerabilities, including two zero-days -- security flaws that were being actively exploited in the wild.

The two zero-days are CVE-2019-0880 and CVE-2019-1132, and both are privilege escalation issues.

They don't allow hackers to take over users' computers remotely, but are used after the hacker has gained access to a system to elevate access rights to a high-privileged account.

The most important of the two zero-days patched today is CVE-2019-1132, a privilege escalation in the Win32k component. The zero-day was discovered by ESET as part of the attack chain of a group of Russian state-funded hackers. The company told ZDNet it plans to publish an in-depth blog post about these attacks and the zero-day tomorrow, July 10.

The second zero-day is CVE-2019-0880. This one is also a privilege escalation, but in splwow64.exe, another Windows core process. This vulnerability was discovered by Resecurity, and no other details about in-the-wild exploitation are currently available.

Besides these two highly critical flaws, Microsoft also patched six other vulnerabilities whose exploitation details became public and could have helped attackers; however, they were not exploited until today, when Microsoft shipped patches. These include:

• CVE-2018-15664 (Docker flaw in Azure)
• CVE-2019-0865 (SymCrypt DoS, see here)
• CVE-2019-0887 (RDP RCE, see here)
• CVE-2019-0962 (Azure Automation elevation of privilege)
• CVE-2019-1068 (Microsoft SQL Server RCE)
• CVE-2019-1129 (ZDNet coverage here)

On top of these, there are also 15 security flaws in the July 2018 Patch Tuesday that have a rating of "Critical," which is Microsoft's highest severity rating.

These include remote code execution and memory corruption flaws in the Windows DHCP server service and the Chakra scripting engine that's used with Microsoft Edge. These are privately reported vulnerabilities, but due to their nature, they will most likely be targeted for exploitation in the future, and patches will need to be applied.

Since the Microsoft Patch Tuesday is also the day when other vendors also release security patches, it's also worth mentioning that Adobe and SAP have also published their respective security updates earlier today.

More in-depth information on today's Patch Tuesday updates is available on Microsoft's official Security Update Guide portal. You can also consult the table embedded below, this Patch Tuesday report generated by ZDNet, or this one, put together by Trend Micro.

More vulnerability reports:

• 7-Eleven Japanese customers lose $500,000 due to mobile app flaw
• Tor Project to fix bug used for DDoS attacks on Onion sites for years
  
• Kubernetes CLI tool security flaw lets attackers run code on host machine
• Backdoor found in Ruby library for checking for strong passwords
• Logitech wireless USB dongles vulnerable to new hijacking flaws
• Cirque du Soleil app gives attackers same admin rights as operators
• KRACK attack: Here's how companies are responding CNET
• Top 10 app vulnerabilities: Unpatched plugins and extensions dominate TechRepublic