With yesterday's Patch Tuesday, Microsoft patched 74 vulnerabilities in Internet Explorer, Edge, Windows and Exchange. Two of the vulnerabilities were already disclosed before the patches were released, but were not actively exploited 'in the wild', according to Microsoft.
These vulnerabilities were in Exchange and ASP.NET Core. The vulnerability in Exchange allowed an attacker to elevate his privileges and the vulnerability in ASP.NET Core made a denial of service attack possible.
Yesterday's Patch Tuesday of March also fixed 14 vulnerabilities in Edge, Internet Explorer and ChakraCore (the Javascript engine of Edge). These vulnerabilities were marked 'Critical' by Microsoft and allow an attacker to remotely execute code. Visiting a malicious website or viewing an infected advertisement was sufficient to become a victim of an exploit of these vulnerabilities.
Microsoft also marked 59 vulnerabilities as 'Important'. Cisco reports on its website that one of those vulnerabilities requires special attention.
That vulnerability is CVE-2018-0883, which is a Windows Shell Remote Code Execution Vulnerability. Cisco writes about this leak, “A remote code execution vulnerability has been identified in Windows Shell. This vulnerability could be exploited by an attacker convincing a user to open a specially crafted file via email, messaging, or other means. An attacker exploiting this vulnerability could execute arbitrary code in context of the current user.”
On most systems the patches are automatically installed through Windows Update.
