Microsoft bu ay yayınladığı Patch Tuesday yamaları ile 3 sıfırıncı gün güvenlik açığı ve toplam 71 zafiyeti kapattı. Microsoft, bu güncellemelerle 71 güvenlik açığını (21 Microsoft Edge güvenlik açığı dahil değil) düzeltti ve bunlardan üçü uzaktan kod yürütülmesine (RCE) izin verdiği için kritik olarak sınıflandırıldı.
Kapatılan zafiyetler aşağıdaki gibidir
- 25 Elevation of Privilege Vulnerabilities
- 3 Security Feature Bypass Vulnerabilities
- 29 Remote Code Execution Vulnerabilities
- 6 Information Disclosure Vulnerabilities
- 4 Denial of Service Vulnerabilities
- 3 Spoofing Vulnerabilities
- 21 Edge – Chromium Vulnerabilities
Üç sıfır gün düzeltildi, hiçbiri aktif olarak kullanılmadı
Açıklanan üç sıfır gün güvenlik açığı için güncellemer yayınlandı. Bu güvenlik açıklarından hiçbiri saldırılarda aktif olarak istismar edilmedi.
- CVE-2022-21990 – Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2022-24459 – Windows Fax and Scan Service Elevation of Privilege Vulnerability
- CVE-2022-24512 – .NET and Visual Studio Remote Code Execution Vulnerability
Bu güvenlik açıklarının hiçbiri saldırılarda kullanılmamış olsa da Microsoft, CVE-2022-21990 ve CVE-2022-24459 için açık kavram kanıtı (PoC) açıkları olduğunu belirtiyor.
- CVE-2022-24508 – Windows SMBv3 Client/Server Remote Code Execution Vulnerability
- CVE-2022-23277 – Microsoft Exchange Server Remote Code Execution Vulnerability
Mart 2022 Yaması Salı Güvenlik Güncellemeleri
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| .NET and Visual Studio | CVE-2022-24512 | .NET and Visual Studio Remote Code Execution Vulnerability | Important |
| .NET and Visual Studio | CVE-2022-24464 | .NET and Visual Studio Denial of Service Vulnerability | Important |
| .NET and Visual Studio | CVE-2020-8927 | Brotli Library Buffer Overflow Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24506 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24517 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24470 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24471 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24520 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24518 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24519 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24515 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24467 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24468 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24469 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Microsoft Defender for Endpoint | CVE-2022-23278 | Microsoft Defender for Endpoint Spoofing Vulnerability | Important |
| Microsoft Defender for IoT | CVE-2022-23265 | Microsoft Defender for IoT Remote Code Execution Vulnerability | Important |
| Microsoft Defender for IoT | CVE-2022-23266 | Microsoft Defender for IoT Elevation of Privilege Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2022-0790 | Chromium: CVE-2022-0790 Use after free in Cast UI | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0789 | Chromium: CVE-2022-0789 Heap buffer overflow in ANGLE | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0809 | Chromium: CVE-2022-0809 Out of bounds memory access in WebXR | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0791 | Chromium: CVE-2022-0791 Use after free in Omnibox | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0803 | Chromium: CVE-2022-0803 Inappropriate implementation in Permissions | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0804 | Chromium: CVE-2022-0804 Inappropriate implementation in Full screen mode | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0801 | Chromium: CVE-2022-0801 Inappropriate implementation in HTML parser | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0802 | Chromium: CVE-2022-0802 Inappropriate implementation in Full screen mode | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0807 | Chromium: CVE-2022-0807 Inappropriate implementation in Autofill | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0808 | Chromium: CVE-2022-0808 Use after free in Chrome OS Shell | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0805 | Chromium: CVE-2022-0805 Use after free in Browser Switcher | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0806 | Chromium: CVE-2022-0806 Data leak in Canvas | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0800 | Chromium: CVE-2022-0800 Heap buffer overflow in Cast UI | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0794 | Chromium: CVE-2022-0794 Use after free in WebShare | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0795 | Chromium: CVE-2022-0795 Type Confusion in Blink Layout | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0792 | Chromium: CVE-2022-0792 Out of bounds read in ANGLE | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0793 | Chromium: CVE-2022-0793 Use after free in Views | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0796 | Chromium: CVE-2022-0796 Use after free in Media | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0798 | Chromium: CVE-2022-0798 Use after free in MediaStream | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0797 | Chromium: CVE-2022-0797 Out of bounds memory access in Mojo | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0799 | Chromium: CVE-2022-0799 Insufficient policy enforcement in Installer | Unknown |
| Microsoft Exchange Server | CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability | Critical |
| Microsoft Exchange Server | CVE-2022-24463 | Microsoft Exchange Server Spoofing Vulnerability | Important |
| Microsoft Intune | CVE-2022-24465 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24510 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24509 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24461 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2022-24462 | Microsoft Word Security Feature Bypass Vulnerability | Important |
| Microsoft Office Word | CVE-2022-24511 | Microsoft Office Word Tampering Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-23287 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-24505 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-23283 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24451 | VP9 Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22007 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22006 | HEVC Video Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2022-24452 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24453 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24501 | VP9 Video Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2022-24457 | HEIF Image Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24456 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22010 | Media Foundation Information Disclosure Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-21977 | Media Foundation Information Disclosure Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23295 | Raw Image Extension Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23300 | Raw Image Extension Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23301 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Paint 3D | CVE-2022-23282 | Paint 3D Remote Code Execution Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2022-21975 | Windows Hyper-V Denial of Service Vulnerability | Important |
| Skype Extension for Chrome | CVE-2022-24522 | Skype Extension for Chrome Information Disclosure Vulnerability | Important |
| Tablet Windows User Interface | CVE-2022-24460 | Tablet Windows User Interface Application Elevation of Privilege Vulnerability | Important |
| Visual Studio Code | CVE-2022-24526 | Visual Studio Code Spoofing Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2022-24507 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows CD-ROM Driver | CVE-2022-24455 | Windows CD-ROM Driver Elevation of Privilege Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2022-23286 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important |
| Windows COM | CVE-2022-23290 | Windows Inking COM Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2022-23281 | Windows Common Log File System Driver Information Disclosure Vulnerability | Important |
| Windows DWM Core Library | CVE-2022-23291 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows DWM Core Library | CVE-2022-23288 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows Event Tracing | CVE-2022-23294 | Windows Event Tracing Remote Code Execution Vulnerability | Important |
| Windows Fastfat Driver | CVE-2022-23293 | Windows Fast FAT File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Fax and Scan Service | CVE-2022-24459 | Windows Fax and Scan Service Elevation of Privilege Vulnerability | Important |
| Windows HTML Platform | CVE-2022-24502 | Windows HTML Platforms Security Feature Bypass Vulnerability | Important |
| Windows Installer | CVE-2022-23296 | Windows Installer Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2022-23297 | Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2022-23298 | Windows NT OS Kernel Elevation of Privilege Vulnerability | Important |
| Windows Media | CVE-2022-21973 | Windows Media Center Update Denial of Service Vulnerability | Important |
| Windows PDEV | CVE-2022-23299 | Windows PDEV Elevation of Privilege Vulnerability | Important |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-23253 | Point-to-Point Tunneling Protocol Denial of Service Vulnerability | Important |
| Windows Print Spooler Components | CVE-2022-23284 | Windows Print Spooler Elevation of Privilege Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-23285 | Remote Desktop Client Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-24503 | Remote Desktop Protocol Client Information Disclosure Vulnerability | Important |
| Windows Security Support Provider Interface | CVE-2022-24454 | Windows Security Support Provider Interface Elevation of Privilege Vulnerability | Important |
| Windows SMB Server | CVE-2022-24508 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability | Important |
| Windows Update Stack | CVE-2022-24525 | Windows Update Stack Elevation of Privilege Vulnerability | Important |
| XBox | CVE-2022-21967 | Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability | Important |
Kaynak: bleepingcomputer.com
