Tech
Microsoft has released today the October 2019 Patch Tuesday security updates. This month's updates can be considered light.
For more than a year, Microsoft has been patching actively exploited zero-days and 80+/90+ vulnerabilities on a monthly basis.
But this month, after a long while, there were no zero-days, a small batch of 59 bugs, of which only nine received a "Critical" rating -- which should, in theory, reduce the probability of patches screwing up Windows features and user systems, as it usually happens after bulky updates.
Because Patch Tuesday data may sometimes be hard to digest due to its sheer size, we summarized the main points in the list below.
We also included data from the security bulletins published by other companies, since many tech firms like to sync security updates with Microsoft's Patch Tuesday, and have sysadmins patch everything in one go.
- Microsoft's official Security Update Guide portal lists all security updates in a filterable table.
- Then there's this one-page put together by ZDNet.
- Additional analysis of today's Patch Tuesday is also available from Cisco Talos, SANS ISC, Tenable, and Trend Micro.
- Microsoft patched an IE zero-day in an out-of-band update last month -- first made available as a manual update, and then later delivered via Windows Update.
- There's another RDP remote code execution bug this month, but this one's nowhere near as dangerous as the BlueKeep and DejaBlue bugs - considered wormable.
- This month, Microsoft patched four memory corruption issues in the Chakra Scripting Engine (ships with Microsoft Edge) that can lead to remote code execution.
- No Adobe security updates this month.
- The SAP security updates are detailed here.
- The Android Security Bulletin is out. Maintainers of the Android OS did not include a fix for a recently disclosed zero-day impacting Samsung, Huawei, and Xiaomi devices.
- However, Google delivered patches for Pixel devices -- see Pixel Security Bulletin for CVE-2019-2215.
| Tag | CVE ID | CVE Title |
|---|---|---|
| Servicing Stack Updates | ADV990001 | Latest Servicing Stack Updates |
| Azure | CVE-2019-1372 | Azure App Service Remote Code Execution Vulnerability |
| Internet Explorer | CVE-2019-1371 | Internet Explorer Memory Corruption Vulnerability |
| Microsoft Browsers | CVE-2019-0608 | Microsoft Browser Spoofing Vulnerability |
| Microsoft Browsers | CVE-2019-1357 | Microsoft Browser Spoofing Vulnerability |
| Microsoft Devices | CVE-2019-1314 | Windows 10 Mobile Security Feature Bypass Vulnerability |
| Microsoft Dynamics | CVE-2019-1375 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability |
| Microsoft Edge | CVE-2019-1356 | Microsoft Edge based on Edge HTML Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1361 | Microsoft Graphics Components Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1362 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1364 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1363 | Windows GDI Information Disclosure Vulnerability |
| Microsoft JET Database Engine | CVE-2019-1358 | Jet Database Engine Remote Code Execution Vulnerability |
| Microsoft JET Database Engine | CVE-2019-1359 | Jet Database Engine Remote Code Execution Vulnerability |
| Microsoft Office | CVE-2019-1331 | Microsoft Excel Remote Code Execution Vulnerability |
| Microsoft Office | CVE-2019-1327 | Microsoft Excel Remote Code Execution Vulnerability |
| Microsoft Office SharePoint | CVE-2019-1330 | Microsoft SharePoint Elevation of Privilege Vulnerability |
| Microsoft Office SharePoint | CVE-2019-1329 | Microsoft SharePoint Elevation of Privilege Vulnerability |
| Microsoft Office SharePoint | CVE-2019-1328 | Microsoft SharePoint Spoofing Vulnerability |
| Microsoft Office SharePoint | CVE-2019-1070 | Microsoft Office SharePoint XSS Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1366 | Chakra Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1060 | MS XML Remote Code Execution Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1307 | Chakra Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1308 | Chakra Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1335 | Chakra Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1239 | VBScript Remote Code Execution Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1238 | VBScript Remote Code Execution Vulnerability |
| Microsoft Windows | CVE-2019-1325 | Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1340 | Microsoft Windows Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1338 | Windows NTLM Security Feature Bypass Vulnerability |
| Microsoft Windows | CVE-2019-1339 | Windows Error Reporting Manager Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1316 | Microsoft Windows Setup Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1342 | Windows Error Reporting Manager Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1311 | Windows Imaging API Remote Code Execution Vulnerability |
| Microsoft Windows | CVE-2019-1344 | Windows Code Integrity Module Information Disclosure Vulnerability |
| Microsoft Windows | CVE-2019-1347 | Windows Denial of Service Vulnerability |
| Microsoft Windows | CVE-2019-1315 | Windows Error Reporting Manager Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1346 | Windows Denial of Service Vulnerability |
| Microsoft Windows | CVE-2019-1317 | Microsoft Windows Denial of Service Vulnerability |
| Microsoft Windows | CVE-2019-1321 | Microsoft Windows CloudStore Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1322 | Microsoft Windows Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1341 | Windows Power Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1319 | Windows Error Reporting Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1318 | Microsoft Windows Transport Layer Security Spoofing Vulnerability |
| Microsoft Windows | CVE-2019-1320 | Microsoft Windows Elevation of Privilege Vulnerability |
| Open Source Software | CVE-2019-1369 | Open Enclave SDK Information Disclosure Vulnerability |
| Secure Boot | CVE-2019-1368 | Windows Secure Boot Security Feature Bypass Vulnerability |
| SQL Server | CVE-2019-1376 | SQL Server Management Studio Information Disclosure Vulnerability |
| SQL Server | CVE-2019-1313 | SQL Server Management Studio Information Disclosure Vulnerability |
| Windows Hyper-V | CVE-2019-1230 | Hyper-V Information Disclosure Vulnerability |
| Windows IIS | CVE-2019-1365 | Microsoft IIS Server Elevation of Privilege Vulnerability |
| Windows Kernel | CVE-2019-1343 | Windows Denial of Service Vulnerability |
| Windows Kernel | CVE-2019-1334 | Windows Kernel Information Disclosure Vulnerability |
| Windows Kernel | CVE-2019-1345 | Windows Kernel Information Disclosure Vulnerability |
| Windows NTLM | CVE-2019-1166 | Windows NTLM Tampering Vulnerability |
| Windows RDP | CVE-2019-1326 | Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability |
| Windows RDP | CVE-2019-1333 | Remote Desktop Client Remote Code Execution Vulnerability |
| Windows Update Stack | CVE-2019-1323 | Microsoft Windows Update Client Elevation of Privilege Vulnerability |
| Windows Update Stack | CVE-2019-1337 | Windows Update Client Information Disclosure Vulnerability |
| Windows Update Stack | CVE-2019-1336 | Microsoft Windows Update Client Elevation of Privilege Vulnerability |