Microsoft Patch Tuesday for May 2021 security updates address 55 vulnerabilities in Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server.
Four vulnerabilities are rated as Critical, 50 as Important and the remaining one as Moderate severity.
Three of these bugs are publicly known but none are actively exploited in the wild at the time of release, 13 of these bugs were reported through the ZDI program.
The critical issues addressed by Microsoft are:
CVE-2021-31166 – HTTP Protocol Stack Remote Code Execution Vulnerability
The flaw could be exploited by an unauthenticated attacker by sending a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets
CVE-2021-28476 – Hyper-V Remote Code Execution Vulnerability
The flaw could allow a guest VM to force the Hyper-V host’s kernel to read from an arbitrary, potentially invalid address.
CVE-2021-27068 – Visual Studio Remote Code Execution Vulnerability
CVE-2020-24587 – Windows Wireless Networking Information Disclosure Vulnerability
An attacker can trigger this issue to disclose the contents of encrypted wireless packets on an affected system.
The full list of CVEs released by Microsoft for May 2021 is available here.
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.