Microsoft's April Patch Tuesday comes with fixes for two Windows zero-days

Today, Microsoft released its monthly batch of security updates known as Patch Tuesday. This month's security release addresses 74 vulnerabilities in a wide range of Microsoft products, including two actively exploited zero-days.

This is the second month in a row that Microsoft has patched two zero-days, after patching two similar issues last month.

The Windows zero-days

The two zero-days patched this month are both the same kind of vulnerability. Both are elevation of privilege vulnerabilities impacting Win32k, a core component of the Windows operating system.

They are CVE-2019-0803 and CVE-2019-0859. Despite being discovered by two separate security teams -Alibaba Cloud Intelligence Security Team, and Kaspersky Lab, respectively- Microsoft describes the two zero-days in the same manner.

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.

The update addresses this vulnerability by correcting how Win32k handles objects in memory.

At the time of writing, no details are available about the two vulnerabilities, except the fact that they've been under active exploitation.

However, if we take into account that Kaspersky has reported to Microsoft six Windows Win32k elevation of privilege zero-days in the past six months, we can safely assume that CVE-2019-0859 is another zero-day exploited by a nation-state hacking group, just like all the zero-days Kaspersky has reported in the past.

Other notable security flaws

But besides the Windows zero-days, there are also other notable security bugs in Microsoft products that users should take note of and prepare to apply this month's patches.

For example, there are three Microsoft Office Access Connectivity bugs (CVE-2019-0824, CVE-2019-0825, CVE-2019-0827) that can allow attackers to execute code on vulnerable systems. All bugs can be exploited remotely, making all three issues dangerous in the context of an enterprise environment.

A similar remote code execution (CVE-2019-0853) also impacts the Windows GDI+ component when parsing EMF files. Taking into account that exploiting this vulnerability can be done by convincing users to visit a website or by emailing users malicious files, this, too, is a very serious issue that users should consider when deciding to apply or delay this month's patches.

Adobe and SAP also release updates.

Since the Microsoft Patch Tuesday is also the day when other vendors also release security patches, it's also worth mentioning that Adobe and SAP also published their respective security updates earlier today.

More in-depth information on today's Patch Tuesday updates is available on Microsoft's official Security Update Guide portal. You can also consult the table embedded below, or to this Patch Tuesday report generated by ZDNet.

Windows 10 May 2019 Update: The new features that matter most

More vulnerability reports:

• Researcher prints 'PWNED!' on hundreds of GPS watches' maps due to unfixed API
• Tens of thousands of cars were left exposed to thieves due to a hardcoded password
  
• Vulnerability found in Xiaomi phones' pre-installed security app
• Backdoor code found in popular Bootstrap-Sass Ruby library
• Apache web server bug grants root access on shared hosting environments
• Researcher publishes Google Chrome exploit on GitHub
• DJI fixes vulnerability that let potential hackers spy on drones CNET
• Top 10 app vulnerabilities: Unpatched plugins and extensions dominate TechRepublic