Tripwire Patch Priority Index for April 2020

Image

Tripwire's April 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft, Oracle, and VMware. Up first on the patch priority list this month is a patch for VMware vCenter Server. This patch resolves an information disclosure vulnerability. This patch has highest priority as proof-of-concept code to exploit the vulnerability exists on the Web as well as in Metasploit. Up next on the patch priority list this month are patches for Microsoft Scripting Engine. These patches resolve 6 vulnerabilities, including remote code execution and memory corruption vulnerabilities. Next on the list are patches for Oracle Java, which resolve vulnerabilities related to concurrency, scripting, serialization, JavaFX, JSSE, libraries, and lightweight HTTP server. Next on the list are patches for Microsoft Office, Excel, Word, and Visual Studio. These patches resolve 6 vulnerabilities, including remote code execution and elevation of privilege. Next this month are patches that affect components of the Windows operating systems. These patches resolve more than 60 vulnerabilities, including denial of service, elevation of privilege, information disclosure, remote code execution, and memory corruption. These vulnerabilities affect Connected User Experiences and Telemetry Service, core Windows, Codecs Library, Push Notification Service, DNS, Jet Database Engine, Adobe Font Manager Library, DirectX, GDI+, Graphics Component, Kernel, Media Foundation, and Windows Update. Next are patches for Hyper-V that resolve 2 elevation of privilege vulnerabilities along with a remote code execution vulnerability. Finally, administrators should focus on server-side patches available for Microsoft Dynamics and SharePoint. These patches resolve remote code execution, cross-site scripting, information disclosure, and spoofing vulnerabilities.

To learn more about Tripwire’s Vulnerability and Exposure Research Team (VERT), including its Patch Priority Index, click here. Or for PPI and more, you can follow VERT on Twitter: @tripwirevert.