Microsoft was released today the established Patch Tuesday for September 2021. The company fixed (or so it claims) two zero days and 60 others errors.
In today's update, the three errorthey are classified as critical, there is one classified as moderate and 56 as important.
Out of a total of 86 vulnerabilities (including Microsoft Edge fixes) we have:
27 Errors Leading to Elevation of Privilege
2 Vulnerabilities to bypass security features
16 Remote code execution vulnerabilities
11 Vulnerabilities for information disclosure
1 Denial of service vulnerabilities
8 Spoofing vulnerabilities
Microsoft has released a security update για την ευπάθεια εκτέλεσης απομακρυσμένου κώδικα (remote code execution) μέσω του Windows MSHTML, η οποία παρακολουθείται στο CVE-2021-40444.
Last Tuesday, Microsoft has revealed that this vulnerability in Windows MSHTML usesare already online in phishing attacks.
These attacks come with malicious Word documents that can download and run a malicious DLL file on the victim's computer.
This file allows the attacker to gain remote access to the victim's device to steal files and spread across the network.
Immediately after Microsoft revealed the vulnerability, too many security people started sharing vulnerability drivers, which now allows anyone to launch attacks, as shown below.
CVE-2021-36968 - Windows DNS Elevation of Privilege Vulnerability
CVE-2021-40444 - Microsoft MSHTML Remote Code Execution Vulnerability