Microsoft's February 2024 Patch Tuesday addresses 73 issues, 2 zero-day flaws

Microsoft's Patch Tuesday for February 2024 addressed a comprehensive set of vulnerabilities across its product range, fixing a total of 73 security flaws alongside updates for six non-Microsoft vulnerabilities. The release patches five critical issues as well as two vulnerabilities that are being actively exploited:

• 16 elevation of privilege vulnerabilities,
• 3 security feature bypass vulnerabilities,
• 30 remote code execution vulnerabilities,
• 5 information disclosure vulnerabilities,
• 9 denial of service vulnerabilities,
• 10 spoofing vulnerabilities.

Separately, Microsoft has released an Edge patch on February 8th.

The critical and zero day items fixed are within Windows, Exchange, Outlook, Dynamics and Hyper-V:

• CVE-2024-21351, a zero day Windows SmartScreen security feature bypass vulnerability, permitted attackers to circumvent SmartScreen's security checks by tricking a user into opening a malicious file.
• CVE-2024-21412, an Internet Shortcut Files security feature bypass vulnerability, allowed attackers to bypass Mark of the Web (MoTW) warnings, thus potentially facilitating unauthorized actions by convincing users to click on a malicious file link. This vulnerability had been exploited by the APT group DarkCasino in targeted campaigns.
• CVE-2024-21410, Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2024-21413,  Microsoft Outlook Remote Code Execution Vulnerability
• CVE-2024-21380, Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
• CVE-2024-20684, Windows Hyper-V Denial of Service Vulnerability
• CVE-2024-21357, Windows Internet Connection Sharing Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

For details on applying updates, Microsoft's official advisory and support pages offers comprehensive resources.

A full list of released patches