Microsoft Security Updates Fixes for 88 Vulnerabilities Including 4 SandboxEscaper Leaked Zero-day’s

Microsoft released a new security update for June 2016 under patch Tuesday that fixes of 88 vulnerabilities including that affected different Microsoft products.

In this June update, Microsoft fixed the vulnerabilities that affected the following software, ⚪Microsoft Windows
⚪Internet Explorer
⚪Microsoft Edge
⚪Microsoft Office and Microsoft Office Services and Web Apps
⚪ChakraCore
⚪Skype for Business and Microsoft Lync
⚪Microsoft Exchange Server
⚪Azure

Microsoft also fixed 4 previous unknown zero-day vulnerabilities that leaked by SandboxEscaper, but none of those vulnerabilities contains neither active exploits nor incorporate the malware.

CVE-2019-0973 – Windows Installer Elevation of Privilege Vulnerability 
CVE-2019-1053 – Windows Shell Elevation of Privilege Vulnerability
CVE-2019-1064 – Windows Elevation of Privilege Vulnerability 
CVE-2019-1069 – Task Scheduler Elevation of Privilege Vulnerability
SandboxEscaper posted all the vulnerability details with PoC Exploits in her GitHub over a month, at this moment, out of five, four zero-day bugs are fixed and the remaining one isn’t ready yet since it leaked very recently.

Total of 88 vulnerabilities that were patched by Microsoft this month, 21 vulnerabilities are rated critical, 66 rated important and one moderate.

Microsoft released an advisory for third-party vulnerabilities fixes including Adobe Flash Player, Microsoft Devices, Servicing Stack Updates.

The Advisory including the Bluetooth Low Energy vulnerability that was disclosed in May. “Due to a misconfiguration in the Bluetooth pairing protocols, it is possible for an attacker who is physically close to a user at the moment he/she uses the security key to communicate with the security key.” Google and Feitian have issued advisories for customers of these keys and Google issued CVE-2019-2102 for this vulnerability.

There are two moderate vulnerabilities CVE-2019-1040 and CVE-2019-1019 were patched by Microsoft that allowed attackers to remotely execute malicious code on any Windows machine or authenticate to any web server.

108

2