Tripwire Patch Priority Index for May 2020

Image

Tripwire's May 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft, Adobe, SaltStack, and VMware. Up first on the patch priority list this month are patches for VMware vCenter Server and SaltStack Salt. The Metasploit exploit framework has recently integrated exploits for VMware vCenter Server (CVE-2020-3952) and SaltStack Salt (CVE-2020-11652, CVE-2020-11651). Administrators with these applications in their networks should patch these vulnerabilities as soon as possible. Up next on the patch priority list this month are patches for Microsoft Scripting Engine, Internet Explorer, and Microsoft Edge. These patches resolve 12 vulnerabilities including remote code execution, spoofing, elevation of privilege, and memory corruption vulnerabilities. Next on the list is a patch for Microsoft Excel, which resolves a remote code execution vulnerability. Up next are patches for Adobe Reader and Acrobat. These patches fix 24 vulnerabilities including denial of service, arbitrary code execution, security feature bypass, and information disclosure vulnerabilities. Next this month are patches that affect components of the Windows operating systems. These patches resolve more than 70 vulnerabilities including denial of service, elevation of privilege, information disclosure, remote code execution, and cross-site scripting vulnerabilities. These vulnerabilities affect Connected User Experiences and Telemetry Service, core Windows, Jet Database Engine, Windows Subsystem for Linux, CSRSS, Clipboard Service, GDI, Graphics Component, Kernel, Media Foundation, Error Reporting, Print Spooler, Printer Service, Windows Runtime, State Repository Service, Storage Service, DirectX, Color Management, Task Scheduler, Hyper-V, Windows Update, and Active Directory Federation Services. Next are patches for .NET Framework & .NET Core, which resolves a denial of service and elevation of privilege vulnerabilities. Finally, administrators should focus on server-side patches available for Microsoft Dynamics and SharePoint. These patches resolve remote code execution, cross-site scripting, information disclosure, and spoofing vulnerabilities.