2021 is looking like another banner year for Patch Wednesday vulnerability disclosures. This month’s Patch Wednesday release includes fixes for Microsoft Windows, Microsoft Edge (EdgeHTML-based), Microsoft Office and Microsoft Office Services and Web Apps, Microsoft Windows Codecs Library, Visual Studio, SQL Server, Microsoft Malware Protection Engine, .NET Core, .NET Repository, ASP .NET and Azure.
Satnam Narang, Staff Research Engineer at Tenable has offered the following perspective:
“In the first Patch Wednesday of 2021, Microsoft addressed 83 CVEs, 10 of which are rated critical. This is a 69% increase in the number of CVEs patched compared to January 2020. If that’s any indication, it means 2021 will be another banner year for Patch Wednesday vulnerability disclosures. This month’s release contains a fix for CVE-2021-1647, a remote code execution flaw in Microsoft Defender.
According to Microsoft, this vulnerability was exploited in the wild as a zero-day, though no further details have been shared. Considering how prevalent Microsoft Defender is, this flaw provides attackers with a large attack surface. Microsoft also patched CVE-2021-1648, an elevation of privilege vulnerability in the printer driver host, splwow64 due to improper validation of user-supplied data.
The vulnerability is marked as publicly disclosed by researchers at Google Project Zero and through the Zero Day Initiative. While it is labelled as an elevation of privilege vulnerability, Microsoft states that it can also be used for information disclosure.”
Find the full analysis here.