Security News > 2023 > March > Microsoft: Patch this severe Outlook bug that Russian miscreants exploited
"The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client," Microsoft explained.
While Microsoft doesn't provide any details about what kind of nefarious deeds attackers are doing after exploiting the bug - or how widespread attacks are - Zero Day Initiative's Dustin Childs advises: "Definitely test and deploy this fix quickly."
The second bug under active exploit is publicly known, and related to a similar vulnerability, CVE-2022-44698, that Microsoft fixed in December 2022.
A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to a targeted server that uses the HTTP Protocol Stack, according to Microsoft.
The final two critical bugs, CVE-2023-1017 and CVE-2023-1018, are a pair of out-of-bounds-read and out-of-bounds-write flaws in Trusted Platform Module 2.0's reference implementation code that are now being fixed in Microsoft products.
The update for Experience Manager fixes 18 bugs that could result in arbitrary code execution, privilege escalation and security feature bypass.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/03/14/microsoft_patch_tuesday/
Related news
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
- Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws (source)
- Windows 10 KB5051974 update force installs new Microsoft Outlook app (source)
- February's Patch Tuesday sees Microsoft offer just 63 fixes (source)
- Microsoft’s Patch Tuesday Fixes 63 Flaws, Including Two Under Active Exploitation (source)
- Patch Tuesday: Microsoft Patches Two Actively Exploited Zero-Day Flaws (source)
- Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts (source)
- If you dread a Microsoft Teams invite, just wait until it turns out to be a Russian phish (source)
- Microsoft fixes Outlook drag-and-drop broken by Windows updates (source)
- Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-02-28 | CVE-2023-1017 | Out-of-bounds Write vulnerability in multiple products An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. | 7.8 |
| 2023-02-28 | CVE-2023-1018 | Out-of-bounds Read vulnerability in multiple products An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. | 5.5 |
| 2022-12-13 | CVE-2022-44698 | Unspecified vulnerability in Microsoft products Windows SmartScreen Security Feature Bypass Vulnerability | 5.4 |