Microsoft Releases July 2024 Security Updates

Jul 12, 2024 GMT+08:00

I. Overview

Microsoft has released its July 2024 Security Updates. A total of 138 security vulnerabilities have been disclosed, among which 5 are marked as important vulnerabilities. Attackers can exploit these vulnerabilities to implement remote code execution, privilege escalation, and security feature bypass. The affected applications include Microsoft Windows, Microsoft Office, SQL Server, and .NET.

For details, visit the Microsoft official website:

https://msrc.microsoft.com/update-guide/releaseNote/2024-Jul

The following vulnerabilities require close scrutiny as their details have been disclosed or they have already been exploited by attackers:

Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-38112): 0-day vulnerability. An unauthenticated remote attacker could exploit the vulnerability by convincing the user to open a specially crafted malicious file. Successful exploitation of the vulnerability can compromise the victim's system. This vulnerability has been exploited in the wild, and the risk is high.

Windows Hyper-V Elevation of Privilege Vulnerability (CVE-2024-38080): 0-day vulnerability. Authenticated local attackers can exploit this vulnerability to gain SYSTEM privileges. This vulnerability has been exploited in the wild, and the risk is high.

.NET and Visual Studio Remote Code Execution Vulnerability (CVE-2024-35264): 0-day vulnerability. An attacker can exploit this vulnerability by closing an http/3 stream while the request body is being processed, leading to a race condition. Successful exploitation of this vulnerability can cause remote code execution. The vulnerability has been disclosed, and the risk is high.

14 vulnerabilities (such as CVE-2024-38060, CVE-2024-38021, and CVE-2024-39684) are marked as Exploitation More Likely. For details, see the official announcement. Please perform security self-check and security hardening in a timely manner to reduce attack risks.

II. Severity

Severity: important

(Severity: low, moderate, important, and critical)

III. Affected Products

Microsoft Windows, Microsoft Office, SQL Server, .NET, and other products.

IV. Vulnerability Details

(Note: Vulnerabilities listed above are important ones. For more information, refer to the official website of Microsoft.)

V. Security Recommendations

1. Use Windows Update or download patches from the following address to fix the vulnerabilities:

https://msrc.microsoft.com/update-guide

2. Back up data remotely to protect your data.

Note: Before fixing vulnerabilities, back up your files and conduct a thorough test.