Microsoft February 2022 Patch Tuesday fixes 48 flaws, 1 zero-day

by chebbi abir

Today is Microsoft’s February 2022 Patch Tuesday, and with it comes fixes for one zero-day vulnerability and a total of 48 flaws.

Microsoft has fixed 48 vulnerabilities (not including 22 Microsoft Edge vulnerabilities ) with today’s update, with none of them classified as Critical.

The number for each type of vulnerability is listed below:

  • 16 Elevation of Privilege Vulnerabilities
  • 3 Security Feature Bypass Vulnerabilities
  • 16 Remote Code Execution Vulnerabilities
  • 5 Information Disclosure Vulnerabilities
  • 5 Denial of Service Vulnerabilities
  • 3 Spoofing Vulnerabilities
  • 22 Edge – Chromium Vulnerabilities

For information about the non-security Windows updates, you can read about today’s Windows 10 KB5010342 & KB5010345 updates and Windows 11’s KB5010386 update.

One zero-day fixed, none actively exploited

This month’s Patch Tuesday includes fixes for one publicly disclosed zero-day vulnerabilities. The good news is that there were no zero-day vulnerabilities actively exploited in attacks from this Patch Tuesday.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The publicly disclosed vulnerabilities fixes as part of the February 2022 Patch Tuesday are:

  •  CVE-2022-21989 – Windows Kernel Elevation of Privilege Vulnerability

However, as many of these have public proof-of-concept exploits available, they will likely be exploited by threat actors soon.

Recent updates from other companies

Other vendors who released updates in February 2022 include:

The February 2022 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the February 2022 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.

Tag CVE ID CVE Title Severity
Azure Data Explorer CVE-2022-23256 Azure Data Explorer Spoofing Vulnerability Important
Kestrel Web Server CVE-2022-21986 .NET Denial of Service Vulnerability Important
Microsoft Dynamics CVE-2022-21957 Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability Important
Microsoft Dynamics GP CVE-2022-23272 Microsoft Dynamics GP Elevation Of Privilege Vulnerability Important
Microsoft Dynamics GP CVE-2022-23271 Microsoft Dynamics GP Elevation Of Privilege Vulnerability Important
Microsoft Dynamics GP CVE-2022-23273 Microsoft Dynamics GP Elevation Of Privilege Vulnerability Important
Microsoft Dynamics GP CVE-2022-23274 Microsoft Dynamics GP Remote Code Execution Vulnerability Important
Microsoft Dynamics GP CVE-2022-23269 Microsoft Dynamics GP Spoofing Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2022-0469 Chromium: CVE-2022-0469 Use after free in Cast Unknown
Microsoft Edge (Chromium-based) CVE-2022-0467 Chromium: CVE-2022-0467 Inappropriate implementation in Pointer Lock Unknown
Microsoft Edge (Chromium-based) CVE-2022-23261 Microsoft Edge (Chromium-based) Tampering Vulnerability Moderate
Microsoft Edge (Chromium-based) CVE-2022-0453 Chromium: CVE-2022-0453 Use after free in Reader Mode Unknown
Microsoft Edge (Chromium-based) CVE-2022-23262 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2022-0468 Chromium: CVE-2022-0468 Use after free in Payments Unknown
Microsoft Edge (Chromium-based) CVE-2022-0452 Chromium: CVE-2022-0452 Use after free in Safe Browsing Unknown
Microsoft Edge (Chromium-based) CVE-2022-23263 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2022-0462 Chromium: CVE-2022-0462 Inappropriate implementation in Scroll Unknown
Microsoft Edge (Chromium-based) CVE-2022-0461 Chromium: CVE-2022-0461 Policy bypass in COOP Unknown
Microsoft Edge (Chromium-based) CVE-2022-0460 Chromium: CVE-2022-0460 Use after free in Window Dialog Unknown
Microsoft Edge (Chromium-based) CVE-2022-0465 Chromium: CVE-2022-0465 Use after free in Extensions Unknown
Microsoft Edge (Chromium-based) CVE-2022-0464 Chromium: CVE-2022-0464 Use after free in Accessibility Unknown
Microsoft Edge (Chromium-based) CVE-2022-0463 Chromium: CVE-2022-0463 Use after free in Accessibility Unknown
Microsoft Edge (Chromium-based) CVE-2022-0459 Chromium: CVE-2022-0459 Use after free in Screen Capture Unknown
Microsoft Edge (Chromium-based) CVE-2022-0455 Chromium: CVE-2022-0455 Inappropriate implementation in Full Screen Mode Unknown
Microsoft Edge (Chromium-based) CVE-2022-0454 Chromium: CVE-2022-0454 Heap buffer overflow in ANGLE Unknown
Microsoft Edge (Chromium-based) CVE-2022-0466 Chromium: CVE-2022-0466 Inappropriate implementation in Extensions Platform Unknown
Microsoft Edge (Chromium-based) CVE-2022-0458 Chromium: CVE-2022-0458 Use after free in Thumbnail Tab Strip Unknown
Microsoft Edge (Chromium-based) CVE-2022-0457 Chromium: CVE-2022-0457 Type Confusion in V8 Unknown
Microsoft Edge (Chromium-based) CVE-2022-0456 Chromium: CVE-2022-0456 Use after free in Web Search Unknown
Microsoft Edge (Chromium-based) CVE-2022-0470 Chromium: CVE-2022-0470 Out of bounds memory access in V8 Unknown
Microsoft Office CVE-2022-22004 Microsoft Office ClickToRun Remote Code Execution Vulnerability Important
Microsoft Office CVE-2022-22003 Microsoft Office Graphics Remote Code Execution Vulnerability Important
Microsoft Office CVE-2022-23252 Microsoft Office Information Disclosure Vulnerability Important
Microsoft Office Excel CVE-2022-22716 Microsoft Excel Information Disclosure Vulnerability Important
Microsoft Office Outlook CVE-2022-23280 Microsoft Outlook for Mac Security Feature Bypass Vulnerability Important
Microsoft Office SharePoint CVE-2022-21987 Microsoft SharePoint Server Spoofing Vulnerability Important
Microsoft Office SharePoint CVE-2022-21968 Microsoft SharePoint Server Security Feature BypassVulnerability Important
Microsoft Office SharePoint CVE-2022-22005 Microsoft SharePoint Server Remote Code Execution Vulnerability Important
Microsoft Office Visio CVE-2022-21988 Microsoft Office Visio Remote Code Execution Vulnerability Important
Microsoft OneDrive CVE-2022-23255 Microsoft OneDrive for Android Security Feature Bypass Vulnerability Important
Microsoft Teams CVE-2022-21965 Microsoft Teams Denial of Service Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-21844 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-21927 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-21926 HEVC Video Extensions Remote Code Execution Vulnerability Important
Microsoft Windows Codecs Library CVE-2022-22709 VP9 Video Extensions Remote Code Execution Vulnerability Important
Power BI CVE-2022-23254 Microsoft Power BI Elevation of Privilege Vulnerability Important
Roaming Security Rights Management Services CVE-2022-21974 Roaming Security Rights Management Services Remote Code Execution Vulnerability Important
Role: DNS Server CVE-2022-21984 Windows DNS Server Remote Code Execution Vulnerability Important
Role: Windows Hyper-V CVE-2022-21995 Windows Hyper-V Remote Code Execution Vulnerability Important
Role: Windows Hyper-V CVE-2022-22712 Windows Hyper-V Denial of Service Vulnerability Important
SQL Server CVE-2022-23276 SQL Server for Linux Containers Elevation of Privilege Vulnerability Important
Visual Studio Code CVE-2022-21991 Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability Important
Windows Common Log File System Driver CVE-2022-22000 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important
Windows Common Log File System Driver CVE-2022-22710 Windows Common Log File System Driver Denial of Service Vulnerability Important
Windows Common Log File System Driver CVE-2022-21981 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important
Windows Common Log File System Driver CVE-2022-21998 Windows Common Log File System Driver Information Disclosure Vulnerability Important
Windows DWM Core Library CVE-2022-21994 Windows DWM Core Library Elevation of Privilege Vulnerability Important
Windows Kernel CVE-2022-21989 Windows Kernel Elevation of Privilege Vulnerability Important
Windows Kernel CVE-2022-21992 Windows Mobile Device Management Remote Code Execution Vulnerability Important
Windows Kernel-Mode Drivers CVE-2022-21993 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability Important
Windows Named Pipe File System CVE-2022-22715 Named Pipe File System Elevation of Privilege Vulnerability Important
Windows Print Spooler Components CVE-2022-22718 Windows Print Spooler Elevation of Privilege Vulnerability Important
Windows Print Spooler Components CVE-2022-22717 Windows Print Spooler Elevation of Privilege Vulnerability Important
Windows Print Spooler Components CVE-2022-21999 Windows Print Spooler Elevation of Privilege Vulnerability Important
Windows Print Spooler Components CVE-2022-21997 Windows Print Spooler Elevation of Privilege Vulnerability Important
Windows Remote Access Connection Manager CVE-2022-21985 Windows Remote Access Connection Manager Information Disclosure Vulnerability Important
Windows Remote Access Connection Manager CVE-2022-22001 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Important
Windows Remote Procedure Call Runtime CVE-2022-21971 Windows Runtime Remote Code Execution Vulnerability Important
Windows User Account Profile CVE-2022-22002 Windows User Account Profile Picture Denial of Service Vulnerability Important
Windows Win32K CVE-2022-21996 Win32k Elevation of Privilege Vulnerability Important

To read the original article: https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2022-patch-tuesday-fixes-48-flaws-1-zero-day/

 

Top

Interdit de copier  ce contenu