Microsoft announced that 30 security vulnerabilities were fixed by "Patch Tuesday" in December, including 4 high risks and 1 zero day.

CTOnews.com, December 14, Microsoft announced today that Patch Tuesday has fixed a total of 30 security vulnerabilities in December, including 4 high-risk vulnerabilities and 1 zero-day vulnerability. CTOnews.com collates related high-risk vulnerabilities and zero-day vulnerability information as follows:

CTOnews.com learned that among the four high-risk vulnerabilities fixed in December, vulnerability numbers "CVE-2023-35641" and "CVE-2023-35630" were related to Windows's built-in ICS (Internet Connection Sharing) service, which allows multiple computers to share a network connection, which allows hackers to use the DHCP service to access a server where the service is enabled, thereby executing malicious code.

▲ source Microsoft vulnerability tracking official website (same as below)

Two other high-risk vulnerabilities are mainly related to Windows built-in applications, including "CVE-2023-35628", which allows hackers to use the "Windows MSHTML platform" in Edge browser IE mode to remotely execute malicious code, and "CVE-2023-36019", which allows hackers to use the "Microsoft Power Platform connector" for phishing attacks.

In terms of zero-day vulnerabilities, the relevant vulnerability tracking number is "CVE-2023-20588", which mainly involves AMD processors, which was first disclosed in August this year.

According to AMD, there is a "division by zero" error on some AMD processors, which may result in the return of speculative data, resulting in information disclosure.