Patch Tuesday Review – August 2022
Welcome to our summary of this month’s Patch Tuesday (August 2022). We have tabulated the vulnerabilities that the latest patches from Microsoft and Adobe fix, so that you can easily export them for use in your vulnerability management program.
Microsoft Patch Tuesday August 2022
121 vulnerabilities have been fixed in Microsoft’s August 2022 update.
17 were marked as Critical vulnerabilities as they allow Elevation of Privilege (EoP) and Remote Code Execution (RCE).
The new patches address CVEs in Microsoft Windows and Windows Components; Azure Batch Node Agent, Real Time Operating System, Site Recovery, and Sphere; Microsoft Dynamics; Microsoft Edge (Chromium-based); Exchange Server; Office and Office Components; PPTP, SSTP, and Remote Access Service PPTP; Hyper-V; System Center Operations Manager; Windows Internet Information Services; Print Spooler Components; and Windows Defender Credential Guard.
This is in addition to the 17 CVEs patched in Microsoft Edge (Chromium-based) and 3 patches related to secure boot from CERT/CC, bringing the total number of MS CVEs to 141.
CVE | Title | Severity | CVSS | Public | Exploited | Type |
---|---|---|---|---|---|---|
CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Important | 7.8 | Yes | Yes | RCE |
CVE-2022-30134 | Microsoft Exchange Information Disclosure Vulnerability | Important | 7.6 | Yes | No | Info |
CVE-2022-30133 | Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability | Critical | 9.8 | No | No | RCE |
CVE-2022-35744 | Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability | Critical | 9.8 | No | No | RCE |
CVE-2022-34691 | Active Directory Domain Services Elevation of Privilege Vulnerability | Critical | 8.8 | No | No | EoP |
CVE-2022-33646 | Azure Batch Node Agent Remote Code Execution Vulnerability | Critical | 7 | No | No | RCE |
CVE-2022-21980 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Critical | 8 | No | No | EoP |
CVE-2022-24477 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Critical | 8 | No | No | EoP |
CVE-2022-24516 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Critical | 8 | No | No | EoP |
CVE-2022-35752 | RAS Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35753 | RAS Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35804 | SMB Client and Server Remote Code Execution Vulnerability | Critical | 8.8 | No | No | RCE |
CVE-2022-34696 | Windows Hyper-V Remote Code Execution Vulnerability | Critical | 7.8 | No | No | RCE |
CVE-2022-34702 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-34714 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35745 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35766 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35767 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-35794 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Critical | 8.1 | No | No | RCE |
CVE-2022-34716 | .NET Spoofing Vulnerability | Important | 5.9 | No | No | Spoofing |
CVE-2022-34685 | Azure RTOS GUIX Studio Information Disclosure Vulnerability | Important | 7.8 | No | No | Info |
CVE-2022-34686 | Azure RTOS GUIX Studio Information Disclosure Vulnerability | Important | 7.8 | No | No | Info |
CVE-2022-30175 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-30176 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-34687 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-35773 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-35779 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-35806 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-35776 | Azure Site Recovery Denial of Service Vulnerability | Important | 6.2 | No | No | DoS |
CVE-2022-35802 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 8.1 | No | No | EoP |
CVE-2022-35775 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35780 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35781 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35782 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35784 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35785 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35786 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35788 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35789 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35790 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35791 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35799 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35801 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35807 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35808 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35809 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35810 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35811 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35813 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35814 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35815 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35816 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35817 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35818 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35819 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
CVE-2022-35774 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 4.9 | No | No | EoP |
CVE-2022-35787 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 4.9 | No | No | EoP |
CVE-2022-35800 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 4.9 | No | No | EoP |
CVE-2022-35783 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 4.4 | No | No | EoP |
CVE-2022-35812 | Azure Site Recovery Elevation of Privilege Vulnerability | Important | 4.4 | No | No | EoP |
CVE-2022-35824 | Azure Site Recovery Remote Code Execution Vulnerability | Important | Unknown | No | No | RCE |
CVE-2022-35772 | Azure Site Recovery Remote Code Execution Vulnerability | Important | 7.2 | No | No | RCE |
CVE-2022-35821 | Azure Sphere Information Disclosure Vulnerability | Important | 4.4 | No | No | Info |
CVE-2022-34301 * | CERT/CC: CVE-2022-34301 Eurosoft Boot Loader Bypass | Important | N/A | No | No | SFB |
CVE-2022-34302 * | CERT/CC: CVE-2022-34302 New Horizon Data Systems Inc Boot Loader Bypass | Important | N/A | No | No | SFB |
CVE-2022-34303 * | CERT/CC: CVE-20220-34303 Crypto Pro Boot Loader Bypass | Important | N/A | No | No | SFB |
CVE-2022-35748 | HTTP.sys Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
CVE-2022-35760 | Microsoft ATA Port Driver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-33649 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | Important | 9.6 | No | No | SFB |
CVE-2022-33648 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-33631 | Microsoft Excel Security Feature Bypass Vulnerability | Important | 7.3 | No | No | SFB |
CVE-2022-34692 | Microsoft Exchange Information Disclosure Vulnerability | Important | 5.3 | No | No | Info |
CVE-2022-21979 | Microsoft Exchange Information Disclosure Vulnerability | Important | 4.8 | No | No | Info |
CVE-2022-34717 | Microsoft Office Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
CVE-2022-35742 | Microsoft Outlook Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
CVE-2022-35743 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
CVE-2022-35762 | Storage Spaces Direct Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35763 | Storage Spaces Direct Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35764 | Storage Spaces Direct Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35765 | Storage Spaces Direct Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35792 | Storage Spaces Direct Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-33640 | System Center Operations Manager: Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35754 | Unified Write Filter Elevation of Privilege Vulnerability | Important | 6.7 | No | No | EoP |
CVE-2022-35777 | Visual Studio Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
CVE-2022-35825 | Visual Studio Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
CVE-2022-35826 | Visual Studio Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
CVE-2022-35827 | Visual Studio Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
CVE-2022-35750 | Win32k Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35820 | Windows Bluetooth Driver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-30144 | Windows Bluetooth Service Remote Code Execution Vulnerability | Important | 7.5 | No | No | RCE |
CVE-2022-35757 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important | 7.3 | No | No | EoP |
CVE-2022-34705 | Windows Defender Credential Guard Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35771 | Windows Defender Credential Guard Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-34704 | Windows Defender Credential Guard Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
CVE-2022-34710 | Windows Defender Credential Guard Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
CVE-2022-34712 | Windows Defender Credential Guard Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
CVE-2022-34709 | Windows Defender Credential Guard Security Feature Bypass Vulnerability | Important | 6 | No | No | SFB |
CVE-2022-35746 | Windows Digital Media Receiver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35749 | Windows Digital Media Receiver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35795 | Windows Error Reporting Service Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-34690 | Windows Fax Service Elevation of Privilege Vulnerability | Important | 7.1 | No | No | EoP |
CVE-2022-35797 | Windows Hello Security Feature Bypass Vulnerability | Important | 6.1 | No | No | SFB |
CVE-2022-35751 | Windows Hyper-V Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35756 | Windows Kerberos Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35761 | Windows Kernel Elevation of Privilege Vulnerability | Important | 8.4 | No | No | EoP |
CVE-2022-34707 | Windows Kernel Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35768 | Windows Kernel Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-34708 | Windows Kernel Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
CVE-2022-35758 | Windows Kernel Memory Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
CVE-2022-30197 | Windows Kernel Security Feature Bypass | Important | 7.8 | No | No | SFB |
CVE-2022-35759 | Windows Local Security Authority (LSA) Denial of Service Vulnerability | Important | 6.5 | No | No | DoS |
CVE-2022-34706 | Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-34715 | Windows Network File System Remote Code Execution Vulnerability | Important | 9.8 | No | No | RCE |
CVE-2022-33670 | Windows Partition Management Driver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-34703 | Windows Partition Management Driver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-35769 | Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
CVE-2022-35747 | Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability | Important | 5.9 | No | No | DoS |
CVE-2022-35755 | Windows Print Spooler Elevation of Privilege Vulnerability | Important | 7.3 | No | No | EoP |
CVE-2022-35793 | Windows Print Spooler Elevation of Privilege Vulnerability | Important | 7.3 | No | No | EoP |
CVE-2022-34701 | Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability | Important | 5.3 | No | No | DoS |
CVE-2022-30194 | Windows WebBrowser Control Remote Code Execution Vulnerability | Important | 7.5 | No | No | RCE |
CVE-2022-34699 | Windows Win32k Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
CVE-2022-33636 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | Moderate | 8.3 | No | No | RCE |
CVE-2022-35796 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | Low | 7.5 | No | No | EoP |
CVE-2022-2603 * | Chromium: CVE-2022-2603 Use after free in Omnibox | High | N/A | No | No | RCE |
CVE-2022-2604 * | Chromium: CVE-2022-2604 Use after free in Safe Browsing | High | N/A | No | No | RCE |
CVE-2022-2605 * | Chromium: CVE-2022-2605 Out of bounds read in Dawn | High | N/A | No | No | RCE |
CVE-2022-2606 * | Chromium: CVE-2022-2606 Use after free in Managed devices API | High | N/A | No | No | RCE |
CVE-2022-2610 * | Chromium: CVE-2022-2610 Insufficient policy enforcement in Background Fetch | Medium | N/A | No | No | SFB |
CVE-2022-2611 * | Chromium: CVE-2022-2611 Inappropriate implementation in Fullscreen API | Medium | N/A | No | No | N/A |
CVE-2022-2612 * | Chromium: CVE-2022-2612 Side-channel information leakage in Keyboard input | Medium | N/A | No | No | Info |
CVE-2022-2614 * | Chromium: CVE-2022-2614 Use after free in Sign-In Flow | Medium | N/A | No | No | RCE |
CVE-2022-2615 * | Chromium: CVE-2022-2615 Insufficient policy enforcement in Cookies | Medium | N/A | No | No | SFB |
CVE-2022-2616 * | Chromium: CVE-2022-2616 Inappropriate implementation in Extensions API | Medium | N/A | No | No | N/A |
CVE-2022-2617 * | Chromium: CVE-2022-2617 Use after free in Extensions API | Medium | N/A | No | No | RCE |
CVE-2022-2618 * | Chromium: CVE-2022-2618 Insufficient validation of untrusted input in Internals | Medium | N/A | No | No | Spoofing |
CVE-2022-2619 * | Chromium: CVE-2022-2619 Insufficient validation of untrusted input in Settings | Medium | N/A | No | No | Spoofing |
CVE-2022-2621 * | Chromium: CVE-2022-2621 Use after free in Extensions | Medium | N/A | No | No | RCE |
CVE-2022-2622 * | Chromium: CVE-2022-2622 Insufficient validation of untrusted input in Safe Browsing | Medium | N/A | No | No | Spoofing |
CVE-2022-2623 * | Chromium: CVE-2022-2623 Use after free in Offline | Medium | N/A | No | No | RCE |
CVE-2022-2624 * | Chromium: CVE-2022-2624 Heap buffer overflow in PDF | Medium | N/A | No | No | RCE |
Adobe Patch Tuesday 2022
Adobe’s August update addresses 25 CVEs in five patches for Adobe Acrobat and Reader, Commerce, Illustrator, FrameMaker, and Adobe Premier Elements.
The updates for Acrobat and Reader address three Critical and four Important bugs. These critical vulnerabilities could allow code execution if an attacker could convince a user to open a specially crafted file.
There are also seven total fixes for Commerce, including four Critical bugs. Two of these could allow code execution and two could lead to a privilege escalation. The XML injection bug fixed by this has the highest CVSS of Adobe’s Patch Tuesday release at 9.1.
The patch for Illustrator contains two Critical and two Important fixes. The most severe could lead to code execution when opening a specially crafted file. Five of the six FrameMaker could lead to code execution.
Finally, there’s a single Critical-rated CVE in the Premier Elements patch resulting from an uncontrolled search path element.
CVE | Title | Severity | CVSS | Vulnerability Impact |
---|---|---|---|---|
CVE-2022-34253 | XML Injection (aka Blind XPath Injection) (CWE-91) | Critical | 9.1 | Arbitrary code execution |
CVE-2022-34254 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | Critical | 8.5 | Arbitrary code execution |
CVE-2022-34255 | Improper Input Validation (CWE-20) | Critical | 8.3 | Privilege escalation |
CVE-2022-34256 | Improper Authorization (CWE-285) | Critical | 8.2 | Privilege escalation |
CVE-2022-35665 | Use After Free (CWE-416) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35666 | Improper Input Validation (CWE-20) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35667 | Out-of-bounds Write (CWE-787) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-34260 | Out-of-bounds Write (CWE-787) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-34263 | Use After Free (CWE-416) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35673 | Out-of-bounds Read (CWE-125) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35674 | Out-of-bounds Read (CWE-125) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35675 | Use After Free (CWE-416) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35676 | Heap-based Buffer Overflow (CWE-122) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-35677 | Heap-based Buffer Overflow (CWE-122) | Critical | 7.8 | Arbitrary code execution |
CVE-2022-34235 | Uncontrolled Search Path Element (CWE-427) | Critical | 8.8 | Privilege escalation |
CVE-2022-34257 | Cross-site Scripting (Stored XSS) (CWE-79) | Important | 6.1 | Arbitrary code execution |
CVE-2022-34259 | Improper Access Control (CWE-284) | Important | 5.3 | Security feature bypass |
CVE-2022-35668 | Improper Input Validation (CWE-20) | Important | 5.5 | Memory leak |
CVE-2022-35670 | Use After Free (CWE-416) | Important | 5.5 | Memory leak |
CVE-2022-35671 | Out-of-bounds Read (CWE-125) | Important | 5.5 | Memory leak |
CVE-2022-35678 | Out-of-bounds Read (CWE-125) | Important | 5.5 | Memory leak |
CVE-2022-34261 | Out-of-bounds Read (CWE-125) | Important | 5.5 | Memory Leak |
CVE-2022-34262 | Out-of-bounds Read (CWE-125) | Important | 5.5 | Memory Leak |
CVE-2022-34264 | Out-of-bounds Read (CWE-125) | Important | 5.5 | Memory leak |
CVE-2022-34258 | Cross-site Scripting (Stored XSS) (CWE-79) | Moderate | 3.5 | Arbitrary code execution |
source https://www.rootshellsecurity.net/patch-tuesday-review-august-2022/
- Get link
- X
- Other Apps
Comments
Post a Comment