resource

Microsoft Patches 6 Zero-Days & 29 RCEs, 97 Vulnerabilities Overall

January 12, 2022 As part of January’s monthly rollup updates, Microsoft has patched 6 Zero-Days and a total of 29 Remote Code Execution vulnerabilities. Overall, Microsoft has patched 97 vulnerabilities across Windows, Hyper-V, and Office.

The Zero-Day Vulnerabilities

CVE-2022-21919 (CVSS 3.1: 7.0, High Severity) – Windows User Profile Service Elevation of Privilege Vulnerability.
CVE-2022-21874 (CVSS 3.1: 7.8, High Severity) – Windows Security Center API Remote Code Execution Vulnerability.
CVE-2022-21839 (CVSS 3.1: 6.1, Medium Severity) – Windows Event Tracing Discretionary ACL List Denial of Service Vulnerability.
CVE-2021-36976 (CVSS 3.1: Not Rated Yet) – Libarchive Remote Code Execution Vulnerability.
CVE-2021-22947 (CVSS 3.1: Not Rated Yet) – Open Source Curl Remote Code Execution Vulnerability.
CVE-2022-21836 (CVSS 3.1: 7.8, High Severity) – Windows Certificate Spoofing Vulnerability.

For the full patched vulnerabilities list, including the 29 RCEs, visit Microsoft January 2022 Security Updates.

Mitigation

CYREBRO recommends implementing the latest available Microsoft security/monthly rollup updates in all relevant systems as soon as possible.