Security News > 2020 > August > August 2020 Patch Tuesday: Microsoft fixes two vulnerabilities under attack

Microsoft has plugged 120 flaws, two of which are being exploited in attacks in the wild.

One is publicly known and being actively exploited, and another one is also under attack.

"CVE-2020-1464 is proof that security organizations should not be making their patching decisions solely off the CVSS score and severity rating and instead should be approaching all the security vulnerabilities as a gap in their attack surface, welcoming any malicious player into their network," noted Richard Melick, Senior Technical Product Manager, Automox.

"In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked 'safe for initialization' in an application or Microsoft Office document that hosts the IE rendering engine," Microsoft explained.

As announced last week, Microsoft has also delivered today a fix for CVE-2020-1337, a privilege escalation vulnerability in the Windows Print Spooler service, which affects all the Windows releases from Windows 7 to Windows 10.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/r_yhxAMYx80/