Tripwire Patch Priority Index for August 2020

Image

Tripwire's August 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft, Adobe, and Apple. Up first on the patch priority list this month are patches for Microsoft and Apple for vulnerabilities that have been integrated into various exploits. Metasploit has recently added exploits for Microsoft .NET Framework, SharePoint Server, and Visual studio (CVE-2020-1147) along with two vulnerabilities impacting various Apple products (CVE-2018-4162 and CVE-2016-4669), including macOS, iOS, iCloud, iTunes, and tvOS. Patches should be applied to these systems as soon as possible. Up next on the patch priority list this month are patches for Microsoft Scripting Engine, Internet Explorer, and Microsoft Edge. These patches resolve 6 vulnerabilities, including remote code execution and memory corruption vulnerabilities. Next on the list are patches for Microsoft Office, Word, Outlook, Excel, and Access, which resolve 13 vulnerabilities including information disclosure, memory corruption, and remote code execution vulnerabilities. Up next are patches for Adobe Reader and Acrobat. These patches resolve 26 issues including memory leak, privilege escalation, arbitrary code execution, security feature bypass, denial of service, and information disclosure vulnerabilities. Next this month are patches that affect components of the Windows operating systems. These patches resolve more than 70 vulnerabilities, including denial of service, elevation of privilege, information disclosure, remote code execution, and memory corruption vulnerabilities. These vulnerabilities affect Connected User Experiences and Telemetry Service, core Windows, Jet Database Engine, WalletService, DirectWrite, Media Foundation, Netlogon, GDI, Windows Speech Runtime, DirectX, Print Spooler, and Image Acquisition Service. Up next is are patches for .NET Framework that resolve remote code execution and elevation of privilege vulnerabilities. Finally, administrators should focus on server-side patches available for Microsoft Dynamics and SharePoint. These patches resolve 7 issues, including cross-site scripting, information disclosure, and spoofing vulnerabilities.