Microsoft’s October 2022 Patch Tuesday, and with it comes fixes for an actively exploited Windows vulnerability and a total of 84 flaws.

Thirteen of the 84 vulnerabilities fixed in today’s update are classified as ‘Critical’ as they allow privilege elevation, spoofing, or remote code execution, one of the most severe types of vulnerabilities.

The number of bugs in each vulnerability category is listed below:

• 39 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 20 Remote Code Execution Vulnerabilities
• 11 Information Disclosure Vulnerabilities
• 8 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

The above counts do not include twelve vulnerabilities fixed in Microsoft Edge on October 3rd.

Two zero-days fixed, one actively exploited

This month’s Patch Tuesday fixes two publicly zero-day vulnerabilities, one actively exploited in attacks and one publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited zero-day vulnerability fixed today is tracked as ‘CVE-2022-41033 – Windows COM+ Event System Service Elevation of Privilege Vulnerability.’

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” reads Microsoft’s advisory.

The exploited vulnerability is listed as discovered by an ‘Anonymous’ researcher.

The publicly disclosed vulnerability is tracked as ‘CVE-2022-41043 – Microsoft Office Information Disclosure Vulnerability’ and was discovered by Cody Thomas of SpecterOps.

Microsoft says attackers could use this vulnerability to gain access to users’ authentication tokens.

Microsoft Exchange zero-days not fixed

Unfortunately, Microsoft has not released security updates for two actively exploited zero-day vulnerabilities tracked as CVE-2022-41040 and CVE-2022-41082, also dubbed to ProxyNotShell.

These vulnerabilities were disclosed in late September by Vietnamese cybersecurity outfit GTSC, who first spotted and reported the attacks.

The vulnerabilities were disclosed to Microsoft through Trend Micro’s Zero Day Initiative and were expected to be fixed today.

However, today’s Microsoft Exchange security bulletin states that the fixes are not ready.

“The October 2022 SUs do not contain fixes for the zero-day vulnerabilities reported publicly on September 29, 2022 (CVE-2022-41040 and CVE-2022-41082),” reads the Microsoft Exchange bulletin.

“Please see this blog post to apply mitigations for those vulnerabilities. We will release updates for CVE-2022-41040 and CVE-2022-41082 when they are ready.”

Recent updates from other companies

Other vendors who released updates in October 2022 include:

• Apple released iOS 16.0.3 with a fix for a Mail denial-of-service vulnerability.
• Cisco released security updates for numerous products this month.
• Fortinet released security updates for an actively exploited authentication bypass vulnerability.
• Google released Android’s October security updates.
• SAP has released its October 2022 Patch Day updates.
• VMware released security updates for VMware ESXi and vCenter Server vulnerabilities.

The October 2022 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the October 2022 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects.,

Original Posts: Microsoft October 2022 Patch Tuesday fixes zero-day used in attacks, 84 flaws