Security News > 2020 > December > Microsoft Wraps Up a Lighter Patch Tuesday for the Holidays

Microsoft has addressed 58 CVEs for its December 2020 Patch Tuesday update.

Also on the Exchange front, CVE-2020-17132 addresses a patch bypass for CVE-2020-16875, which was reported and patched in September's Patch Tuesday release.

"That patch corrects a bug within the JIT compiler. By performing actions in JavaScript, an attacker can trigger a memory-corruption condition, which leads to code execution. The lack of browser updates could also be a conscious decision by Microsoft to ensure a bad patch for a browser does not disrupt online shopping during the holiday season."

Though it's a lighter than usual month for the volume of patches, the steady flow of critical RCE bugs present a great deal of risk, said Justin Knapp, researcher at Automox, via email.

"This is a book-end to a year that began with Microsoft addressing 49 CVEs in January of 2020, followed by eight consecutive months with over 90 CVEs addressed. In 2020, Microsoft released patches for over 1,200 CVEs," Satnam Narang, principal research engineer, Tenable, told Threatpost.

News URL

https://threatpost.com/microsoft-patch-tuesday-holidays/162041/