Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

CVE Issued by Tag CVE ID CVE Title
Microsoft.NET and Visual Studio CVE-2023-33127 .NET and Visual Studio Elevation of Privilege Vulnerability
MicrosoftASP.NET and Visual Studio CVE-2023-33170 ASP.NET and Visual Studio Security Feature Bypass Vulnerability
MicrosoftAzure Active Directory CVE-2023-36871 Azure Active Directory Security Feature Bypass Vulnerability
MicrosoftAzure Active Directory CVE-2023-35348 Active Directory Federation Service Security Feature Bypass Vulnerability
MicrosoftMicrosoft Dynamics CVE-2023-33171 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
MicrosoftMicrosoft Dynamics CVE-2023-35335 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
MicrosoftMicrosoft Graphics Component CVE-2023-33149 Microsoft Office Graphics Remote Code Execution Vulnerability
MicrosoftMicrosoft Graphics Component CVE-2023-21756 Windows Win32k Elevation of Privilege Vulnerability
MicrosoftMicrosoft Media-Wiki Extensions CVE-2023-35333 MediaWiki PandocUpload Extension Remote Code Execution Vulnerability
MicrosoftMicrosoft Office CVE-2023-33148 Microsoft Office Elevation of Privilege Vulnerability
MicrosoftMicrosoft Office CVE-2023-36884 Office and Windows HTML Remote Code Execution Vulnerability
MicrosoftMicrosoft Office CVE-2023-33150 Microsoft Office Security Feature Bypass Vulnerability
MicrosoftMicrosoft Office Access CVE-2023-33152 Microsoft ActiveX Remote Code Execution Vulnerability
MicrosoftMicrosoft Office Excel CVE-2023-33158 Microsoft Excel Remote Code Execution Vulnerability
MicrosoftMicrosoft Office Excel CVE-2023-33161 Microsoft Excel Remote Code Execution Vulnerability
MicrosoftMicrosoft Office Excel CVE-2023-33162 Microsoft Excel Information Disclosure Vulnerability
MicrosoftMicrosoft Office Outlook CVE-2023-33151 Microsoft Outlook Spoofing Vulnerability
MicrosoftMicrosoft Office Outlook CVE-2023-33153 Microsoft Outlook Remote Code Execution Vulnerability
MicrosoftMicrosoft Office Outlook CVE-2023-35311 Microsoft Outlook Security Feature Bypass Vulnerability
MicrosoftMicrosoft Office SharePoint CVE-2023-33134 Microsoft SharePoint Server Remote Code Execution Vulnerability
MicrosoftMicrosoft Office SharePoint CVE-2023-33160 Microsoft SharePoint Server Remote Code Execution Vulnerability
MicrosoftMicrosoft Office SharePoint CVE-2023-33165 Microsoft SharePoint Server Security Feature Bypass Vulnerability
MicrosoftMicrosoft Office SharePoint CVE-2023-33157 Microsoft SharePoint Remote Code Execution Vulnerability
MicrosoftMicrosoft Office SharePoint CVE-2023-33159 Microsoft SharePoint Server Spoofing Vulnerability
MicrosoftMicrosoft Power Apps CVE-2023-32052 Microsoft Power Apps Spoofing Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-32085 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-35302 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-35296 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-35324 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-32040 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-35306 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Printer Drivers CVE-2023-32039 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
MicrosoftMicrosoft Windows Codecs Library CVE-2023-35303 USB Audio Class System Driver Remote Code Execution Vulnerability
MicrosoftMicrosoft Windows Codecs Library CVE-2023-36872 VP9 Video Extensions Information Disclosure Vulnerability
MicrosoftMicrosoft Windows Codecs Library CVE-2023-32051 Raw Image Extension Remote Code Execution Vulnerability
MicrosoftMono Authenticode CVE-2023-35373 Mono Authenticode Validation Spoofing Vulnerability
MicrosoftPaint 3D CVE-2023-35374 Paint 3D Remote Code Execution Vulnerability
MicrosoftPaint 3D CVE-2023-32047 Paint 3D Remote Code Execution Vulnerability
MicrosoftRole: DNS Server CVE-2023-35310 Windows DNS Server Remote Code Execution Vulnerability
MicrosoftRole: DNS Server CVE-2023-35346 Windows DNS Server Remote Code Execution Vulnerability
MicrosoftRole: DNS Server CVE-2023-35345 Windows DNS Server Remote Code Execution Vulnerability
MicrosoftRole: DNS Server CVE-2023-35344 Windows DNS Server Remote Code Execution Vulnerability
MicrosoftService Fabric CVE-2023-36868 Azure Service Fabric on Windows Information Disclosure Vulnerability
MicrosoftVisual Studio Code CVE-2023-36867 Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
MicrosoftWindows Active Directory Certificate Services CVE-2023-35351 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
MicrosoftWindows Active Directory Certificate Services CVE-2023-35350 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
MicrosoftWindows Active Template Library CVE-2023-32055 Active Template Library Elevation of Privilege Vulnerability
MicrosoftWindows Admin Center CVE-2023-29347 Windows Admin Center Spoofing Vulnerability
MicrosoftWindows App Store CVE-2023-35347 Microsoft Install Service Elevation of Privilege Vulnerability
MicrosoftWindows Authentication Methods CVE-2023-35329 Windows Authentication Denial of Service Vulnerability
MicrosoftWindows CDP User Components CVE-2023-35326 Windows CDP User Components Information Disclosure Vulnerability
MicrosoftWindows Certificates ADV230001 Guidance on Microsoft Signed Drivers Being Used Maliciously
MicrosoftWindows Clip Service CVE-2023-35362 Windows Clip Service Elevation of Privilege Vulnerability
MicrosoftWindows Cloud Files Mini Filter Driver CVE-2023-33155 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
MicrosoftWindows Cluster Server CVE-2023-32033 Microsoft Failover Cluster Remote Code Execution Vulnerability
MicrosoftWindows CNG Key Isolation Service CVE-2023-35340 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
MicrosoftWindows Common Log File System Driver CVE-2023-35299 Windows Common Log File System Driver Elevation of Privilege Vulnerability
MicrosoftWindows Connected User Experiences and Telemetry CVE-2023-35320 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
MicrosoftWindows Connected User Experiences and Telemetry CVE-2023-35353 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
MicrosoftWindows CryptoAPI CVE-2023-35339 Windows CryptoAPI Denial of Service Vulnerability
MicrosoftWindows Cryptographic Services CVE-2023-33174 Windows Cryptographic Information Disclosure Vulnerability
MicrosoftWindows Defender CVE-2023-33156 Microsoft Defender Elevation of Privilege Vulnerability
MicrosoftWindows Deployment Services CVE-2023-35322 Windows Deployment Services Remote Code Execution Vulnerability
MicrosoftWindows Deployment Services CVE-2023-35321 Windows Deployment Services Denial of Service Vulnerability
MicrosoftWindows EFI Partition ADV230002 Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules
MicrosoftWindows Error Reporting CVE-2023-36874 Windows Error Reporting Service Elevation of Privilege Vulnerability
MicrosoftWindows Failover Cluster CVE-2023-32083 Microsoft Failover Cluster Information Disclosure Vulnerability
MicrosoftWindows Geolocation Service CVE-2023-35343 Windows Geolocation Service Remote Code Execution Vulnerability
MicrosoftWindows HTTP.sys CVE-2023-32084 HTTP.sys Denial of Service Vulnerability
MicrosoftWindows HTTP.sys CVE-2023-35298 HTTP.sys Denial of Service Vulnerability
MicrosoftWindows Image Acquisition CVE-2023-35342 Windows Image Acquisition Elevation of Privilege Vulnerability
MicrosoftWindows Installer CVE-2023-32053 Windows Installer Elevation of Privilege Vulnerability
MicrosoftWindows Installer CVE-2023-32050 Windows Installer Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35304 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35363 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35305 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35356 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35357 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Kernel CVE-2023-35358 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows Layer 2 Tunneling Protocol CVE-2023-32037 Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability
MicrosoftWindows Layer-2 Bridge Network Driver CVE-2023-35315 Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability
MicrosoftWindows Local Security Authority (LSA) CVE-2023-35331 Windows Local Security Authority (LSA) Denial of Service Vulnerability
MicrosoftWindows Media CVE-2023-35341 Microsoft DirectMusic Information Disclosure Vulnerability
MicrosoftWindows Message Queuing CVE-2023-32057 Microsoft Message Queuing Remote Code Execution Vulnerability
MicrosoftWindows Message Queuing CVE-2023-35309 Microsoft Message Queuing Remote Code Execution Vulnerability
MicrosoftWindows Message Queuing CVE-2023-32045 Microsoft Message Queuing Denial of Service Vulnerability
MicrosoftWindows Message Queuing CVE-2023-32044 Microsoft Message Queuing Denial of Service Vulnerability
MicrosoftWindows MSHTML Platform CVE-2023-32046 Windows MSHTML Platform Elevation of Privilege Vulnerability
MicrosoftWindows MSHTML Platform CVE-2023-35336 Windows MSHTML Platform Security Feature Bypass Vulnerability
MicrosoftWindows MSHTML Platform CVE-2023-35308 Windows MSHTML Platform Security Feature Bypass Vulnerability
MicrosoftWindows Netlogon CVE-2023-21526 Windows Netlogon Information Disclosure Vulnerability
MicrosoftWindows Network Load Balancing CVE-2023-33163 Windows Network Load Balancing Remote Code Execution Vulnerability
MicrosoftWindows NT OS Kernel CVE-2023-35361 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows NT OS Kernel CVE-2023-35364 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows NT OS Kernel CVE-2023-35360 Windows Kernel Elevation of Privilege Vulnerability
MicrosoftWindows ODBC Driver CVE-2023-32038 Microsoft ODBC Driver Remote Code Execution Vulnerability
MicrosoftWindows OLE CVE-2023-32042 OLE Automation Information Disclosure Vulnerability
MicrosoftWindows Online Certificate Status Protocol (OCSP) SnapIn CVE-2023-35323 Windows OLE Remote Code Execution Vulnerability
MicrosoftWindows Online Certificate Status Protocol (OCSP) SnapIn CVE-2023-35313 Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability
MicrosoftWindows Partition Management Driver CVE-2023-33154 Windows Partition Management Driver Elevation of Privilege Vulnerability
MicrosoftWindows Peer Name Resolution Protocol CVE-2023-35338 Windows Peer Name Resolution Protocol Denial of Service Vulnerability
MicrosoftWindows PGM CVE-2023-35297 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
MicrosoftWindows Print Spooler Components CVE-2023-35325 Windows Print Spooler Information Disclosure Vulnerability
MicrosoftWindows Remote Desktop CVE-2023-35352 Windows Remote Desktop Security Feature Bypass Vulnerability
MicrosoftWindows Remote Desktop CVE-2023-32043 Windows Remote Desktop Security Feature Bypass Vulnerability
MicrosoftWindows Remote Desktop CVE-2023-35332 Windows Remote Desktop Protocol Security Feature Bypass
MicrosoftWindows Remote Procedure Call CVE-2023-35300 Remote Procedure Call Runtime Remote Code Execution Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33168 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33173 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33172 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-32035 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33166 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-32034 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33167 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33169 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-35318 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-33164 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-35319 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-35316 Remote Procedure Call Runtime Information Disclosure Vulnerability
MicrosoftWindows Remote Procedure Call CVE-2023-35314 Remote Procedure Call Runtime Denial of Service Vulnerability
MicrosoftWindows Routing and Remote Access Service (RRAS) CVE-2023-35367 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
MicrosoftWindows Routing and Remote Access Service (RRAS) CVE-2023-35366 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
MicrosoftWindows Routing and Remote Access Service (RRAS) CVE-2023-35365 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
MicrosoftWindows Server Update Service CVE-2023-35317 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
MicrosoftWindows Server Update Service CVE-2023-32056 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
MicrosoftWindows SmartScreen CVE-2023-32049 Windows SmartScreen Security Feature Bypass Vulnerability
MicrosoftWindows SPNEGO Extended Negotiation CVE-2023-35330 Windows Extended Negotiation Denial of Service Vulnerability
MicrosoftWindows Transaction Manager CVE-2023-35328 Windows Transaction Manager Elevation of Privilege Vulnerability
MicrosoftWindows Update Orchestrator Service CVE-2023-32041 Windows Update Orchestrator Service Information Disclosure Vulnerability
MicrosoftWindows VOLSNAP.SYS CVE-2023-35312 Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability
MicrosoftWindows Volume Shadow Copy CVE-2023-32054 Volume Shadow Copy Elevation of Privilege Vulnerability
MicrosoftWindows Win32K CVE-2023-35337 Win32k Elevation of Privilege Vulnerability

CVE-2023-21756 - Windows Win32k Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-21756
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Windows Win32k Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-21756
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Elevation of Privilege 5027230 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Elevation of Privilege 5027230 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Elevation of Privilege 5027219 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Elevation of Privilege 5027219 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Elevation of Privilege 5027222
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Elevation of Privilege 5027222
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Elevation of Privilege 5027222
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Elevation of Privilege 5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Elevation of Privilege 5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Elevation of Privilege 5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Elevation of Privilege
5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Elevation of Privilege
5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Elevation of Privilege
5027215
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Elevation of Privilege 5027223
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Elevation of Privilege 5027223
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Elevation of Privilege 5027231
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Elevation of Privilege 5027231
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Elevation of Privilege 5027283
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Elevation of Privilege 5027283
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Elevation of Privilege 5027271
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Elevation of Privilege 5027271
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Elevation of Privilege 5027219 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Elevation of Privilege 5027219 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Elevation of Privilege 5027222
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Elevation of Privilege 5027222
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Elevation of Privilege 5027225
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Elevation of Privilege 5027225
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-21756 Microsoft Input and Composition Servicing team


CVE-2023-33148 - Microsoft Office Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33148
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Office Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to local clients only.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33148
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33148 Ruslan Sayfiev and Denis Faiustov


CVE-2023-33149 - Microsoft Office Graphics Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33149
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Office Graphics Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:7.8/TemporalScore:6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

Is the Preview Pane an attack vector for this vulnerability?

Yes, the Preview Pane is an attack vector.


There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?

Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.


According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send the user a malicious file and convince them to open it.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33149
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2013 RT Service Pack 1 5002400 (Security Update)
5001952 (Security Update)
Important Remote Code Execution 5002279
4464542
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (32-bit editions) 5002400 (Security Update)
5001952 (Security Update)
Important Remote Code Execution 5002279
4464542
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (64-bit editions) 5002400 (Security Update)
5001952 (Security Update)
Important Remote Code Execution 5002279
4464542
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2016 (32-bit edition) 5002419 (Security Update)
4493154 (Security Update)
Important Remote Code Execution 5002288
4011628
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2016 (64-bit edition) 5002419 (Security Update)
4493154 (Security Update)
Important Remote Code Execution 5002288
4011628
Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for Mac Release Notes (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.75.23070901 Maybe None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC for Mac 2021 Release Notes (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.75.23070901 Maybe None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33149 willJ of vulnerability research institute


CVE-2023-33150 - Microsoft Office Security Feature Bypass Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33150
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Office Security Feature Bypass Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:9.6/TemporalScore:8.3
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires the victim to open a specially crafted file and click through Office Security Prompt(s). An attacker would have no way to force users to open the file.,

  • In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
  • In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

Is the Attachment Preview Pane an attack vector for this vulnerability?

Yes. The attachment Preview Pane that is accessed when a user clicks to preview an attached file is an attack vector; however, the email Preview Pane itself is not.


What kind of security feature could be bypassed by successfully exploiting this vulnerability?

Successful exploitation of this vulnerability would allow an attacker to escape the Office Protected View.


Is Application Guard for Office affected by this vulnerability?

No. Customers using Application Guard for Office are not affected.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Security Feature Bypass

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33150
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Security Feature Bypass None Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Word 2013 RT Service Pack 1 5002411 (Security Update) Important Security Feature Bypass 5002365 Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Word 2013 Service Pack 1 (32-bit editions) 5002411 (Security Update) Important Security Feature Bypass 5002365 Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Word 2013 Service Pack 1 (64-bit editions) 5002411 (Security Update) Important Security Feature Bypass 5002365 Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Word 2016 (32-bit edition) 5002406 (Security Update) Important Security Feature Bypass 5002369 Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Word 2016 (64-bit edition) 5002406 (Security Update) Important Security Feature Bypass 5002369 Base: 9.6
Temporal: 8.3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33150 Ben Lichtman


CVE-2023-33151 - Microsoft Outlook Spoofing Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33151
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Outlook Spoofing Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

The user would have to click on a specially crafted URL to be compromised by the attacker.


Is the Preview Pane an attack vector for this vulnerability?

Yes. The Preview Pane is an attack vector, but additional user interaction is required.


What type of information could be disclosed by this vulnerability?

Exploiting this vulnerability could allow the disclosure of NetNTLMv2 hashes.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Spoofing

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33151
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Spoofing None Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Outlook 2013 (32-bit editions) 5002432 (Security Update) Important Spoofing 5002382 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Outlook 2013 (64-bit editions) 5002432 (Security Update) Important Spoofing 5002382 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Outlook 2013 RT Service Pack 1 5002432 (Security Update) Important Spoofing 5002382 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Outlook 2016 (32-bit edition) 5002427 (Security Update) Important Spoofing 5002387 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Outlook 2016 (64-bit edition) 5002427 (Security Update) Important Spoofing 5002387 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33151 Jordan Hopkins - Rootshell Security


CVE-2023-33152 - Microsoft ActiveX Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33152
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft ActiveX Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:7.0/TemporalScore:6.1
Base score metrics
Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires that a user open a specially crafted file.

  • In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
  • In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires the victim to open a document and click through multiple warning popups for the attack to be initiated.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33152
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2013 RT Service Pack 1 5002069 (Security Update) Important Remote Code Execution 4018332 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (32-bit editions) 5002069 (Security Update) Important Remote Code Execution 4018332 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (64-bit editions) 5002069 (Security Update) Important Remote Code Execution 4018332 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2016 (32-bit edition) 5002058 (Security Update) Important Remote Code Execution 4461476 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2016 (64-bit edition) 5002058 (Security Update) Important Remote Code Execution 4461476 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33152 Greg Linares (@Laughing_Mantis)


CVE-2023-33153 - Microsoft Outlook Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33153
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Outlook Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.8/TemporalScore:5.9
Base score metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires that a user open a specially crafted file.

  • In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
  • In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33153
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2013 RT Service Pack 1 4464506 (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (32-bit editions) 4464506 (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2013 Service Pack 1 (64-bit editions) 4464506 (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
15.0.5571.1000 Maybe None
Microsoft Office 2016 (32-bit edition) 4475581 (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2016 (64-bit edition) 4475581 (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
16.0.5404.1000 Maybe None
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
https://aka.ms/OfficeSecurityReleases No None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33153 Greg Linares (@Laughing_Mantis)


CVE-2023-33165 - Microsoft SharePoint Server Security Feature Bypass Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33165
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft SharePoint Server Security Feature Bypass Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:4.3/TemporalScore:3.8
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?

The attacker who successfully exploits the vulnerability could download files without the access being logged.


What kind of security feature could be bypassed by successfully exploiting this vulnerability?

An attacker could bypass the logging of downloaded files.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Security Feature Bypass

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33165
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Microsoft SharePoint Server 2019 5002423 (Security Update) Important Security Feature Bypass 5002402 Base: 4.3
Temporal: 3.8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C
16.0.10400.20008 Maybe None
Microsoft SharePoint Server Subscription Edition 5002424 (Security Update) Important Security Feature Bypass 5002416 Base: 4.3
Temporal: 3.8
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C
16.0.16130.20642 Maybe None

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33165 Anonymous


Anonymous


CVE-2023-33166 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33166
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33166
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33166 Microsoft Offensive Research & Security Engineering. with Microsoft


CVE-2023-33167 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33167
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33167
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33167 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-33168 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33168
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33168
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33168 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-33169 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33169
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33169
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33169 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-33172 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33172
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33172
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33172 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-33173 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33173
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33173
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33173 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-33174 - Windows Cryptographic Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-33174
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Windows Cryptographic Information Disclosure Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:5.5/TemporalScore:4.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-33174
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Information Disclosure 5027230 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Information Disclosure 5027230 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Information Disclosure 5027219 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Information Disclosure 5027219 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Information Disclosure 5027223
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Information Disclosure 5027223
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Information Disclosure 5027231
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Information Disclosure 5027231
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Information Disclosure 5027279
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Information Disclosure 5027279
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Information Disclosure 5027279
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Information Disclosure 5027279
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Information Disclosure 5027275
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Information Disclosure 5027275
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Information Disclosure 5027283
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Information Disclosure 5027283
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Information Disclosure 5027271
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Information Disclosure 5027271
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Information Disclosure 5027219 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Information Disclosure 5027219 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Information Disclosure 5027222
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Information Disclosure 5027222
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Information Disclosure 5027225
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Information Disclosure 5027225
Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-33174 ziming zhang with Ant Security Light-Year Lab


CVE-2023-32033 - Microsoft Failover Cluster Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-32033
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Microsoft Failover Cluster Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.6/TemporalScore:5.8
Base score metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires the attacker or targeted user to have specific elevated privileges. Only users with roles “Cluster Admin” and “Cluster Operator” can access this.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32033
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Remote Code Execution 5027279
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Remote Code Execution 5027279
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Remote Code Execution 5027279
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Remote Code Execution 5027279
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Remote Code Execution 5027275
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Remote Code Execution 5027275
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Remote Code Execution 5027283
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Remote Code Execution 5027283
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Remote Code Execution 5027271
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Remote Code Execution 5027271
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Remote Code Execution 5027219 Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Remote Code Execution 5027219 Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Remote Code Execution 5027222
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Remote Code Execution 5027222
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Remote Code Execution 5027225
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Remote Code Execution 5027225
Base: 6.6
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-32033 k0shl with Kunlun Lab


CVE-2023-32034 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-32034
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32034
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-32034 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-32035 - Remote Procedure Call Runtime Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-32035
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Remote Procedure Call Runtime Denial of Service Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32035
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 for 32-bit Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 for x64-based Systems 5028186 (Security Update) Important Denial of Service 5027230 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.10240.20048 Yes None
Windows 10 Version 1607 for 32-bit Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1607 for x64-based Systems 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Denial of Service
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Denial of Service 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Denial of Service 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows Server 2008 for 32-bit Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5028222 (Monthly Rollup)
5028226 (Security Only)
Important Denial of Service 5027279
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.0.6003.22175
Yes 5028222
5028226
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5028240 (Monthly Rollup)
5028224 (Security Only)
Important Denial of Service 5027275
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.1.7601.26623
Yes 5028240
5028224
Windows Server 2012 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 (Server Core installation) 5028232 (Monthly Rollup)
5028233 (Security Only)
Important Denial of Service 5027283
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.2.9200.24374 Yes None
Windows Server 2012 R2 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2012 R2 (Server Core installation) 5028228 (Monthly Rollup)
5028223 (Security Only)
Important Denial of Service 5027271
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
6.3.9600.21063
6.3.9600.21075
Yes None
Windows Server 2016 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2016 (Server Core installation) 5028169 (Security Update) Important Denial of Service 5027219 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.14393.6085 Yes None
Windows Server 2019 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2019 (Server Core installation) 5028168 (Security Update) Important Denial of Service 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows Server 2022 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171
Windows Server 2022 (Server Core installation) 5028171 (Security Update) Important Denial of Service 5027225
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
10.0.20348.1850
Yes 5028171

Acknowledgements

CVE ID Acknowledgements
CVE-2023-32035 Microsoft Offensive Research & Security Engineering with Microsoft


CVE-2023-32037 - Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-32037
MITRE
NVD

Issuing CNA: Microsoft

CVE Title: Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability
CVSS:

CVSS:3.1 Highest BaseScore:6.5/TemporalScore:5.7
Base score metrics
Attack VectorAdjacent
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

Executive Summary:
None
FAQ:

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.


According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability?

This attack is limited to systems connected to the same network segment as the attacker. The attack cannot be performed across multiple networks (for example, a WAN) and would be limited to systems on the same network switch or virtual network.


Mitigations:
None
Workarounds:
None
Revision:
1.0    11-Jul-23    

Information published.


Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-32037
Product KB Article Severity Impact Supercedence CVSS Score Set Fixed Build Restart Required Known Issue
Windows 10 Version 1809 for 32-bit Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for ARM64-based Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 1809 for x64-based Systems 5028168 (Security Update) Important Information Disclosure 5027222
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.17763.4645
Yes 5028168
Windows 10 Version 21H2 for 32-bit Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for ARM64-based Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 21H2 for x64-based Systems 5028166 (Security Update) Important Information Disclosure 5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.19041.3208
Yes 5028166
Windows 10 Version 22H2 for 32-bit Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for ARM64-based Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 10 Version 22H2 for x64-based Systems 5028166 (Security Update) Important Information Disclosure
5027215
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

10.0.19045.3208
Yes 5028166
Windows 11 version 21H2 for ARM64-based Systems 5028182 (Security Update) Important Information Disclosure 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 version 21H2 for x64-based Systems 5028182 (Security Update) Important Information Disclosure 5027223
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22000.2176
Yes 5028182
Windows 11 Version 22H2 for ARM64-based Systems 5028185 (Security Update) Important Information Disclosure 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22621.1992
Yes 5028185
Windows 11 Version 22H2 for x64-based Systems 5028185 (Security Update) Important Information Disclosure 5027231
Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
10.0.22621.1992
Yes