Microsoft rolls out fixes for 69 CVEs through the June 2023 Patch Tuesday
9 min. read
Updated on
Share this article
Improve this guide
Read our disclosure page to find out how can you help Windows Report sustain the editorial team Read more
Key notes
- A pretty busy month for a Microsoft Patch Tuesday release, with 69 CVEs.
- Out of all the CVEs, 6 are rated Critical, 62 Important, and one Moderate.
- We've included each and every one in this article, with direct links as well
It’s June and we are already enjoying the summer, but Windows users are also looking towards Microsoft, in hopes that some of the flaws they’ve been struggling with will finally get fixed.
We’ve already provided the direct download links for the cumulative updates released today for Windows 10 and 11, but now it’s time to talk about Critical Vulnerabilities and Exposures again.
This month, the Redmond-based tech giant released 69 new patches, which is a lot more than some people were expecting in the middle of the summer.
These software updates address CVEs in:
- Microsoft Windows and Windows Components
- Office and Office Components
- Exchange Server
- Microsoft Edge (Chromium-based)
- SharePoint Server
- .NET and Visual Studio
- Microsoft Teams; Azure DevOps
- Microsoft Dynamics
- Remote Desktop Client
We’re going to take a more in-depth look at this release and see exactly what vulnerabilities we can scratch off our lists.
Microsoft managed to eliminate 69 OS vulnerabilities
It goes without saying that this isn’t either one of the busiest or the lightest months for Microsoft security experts.
You might like to know that, out of the 69 new CVEs released, six are rated Critical, 62 are rated Important, and one is rated Moderate in severity.
Notably, this volume of fixes is a bit larger than what we all expected for June, but not extraordinary, so there’s no need to worry.
It’s important to know that none of the new bugs patched this month are listed as publicly known or under active attack at the time of release.
| CVE | Title | Severity | CVSS | Public | Exploited | Type |
| CVE-2023-24897 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability | Critical | 7.8 | No | No | RCE |
| CVE-2023-29357 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Critical | 9.8 | No | No | EoP |
| CVE-2023-32013 | Windows Hyper-V Denial of Service Vulnerability | Critical | 6.5 | No | No | DoS |
| CVE-2023-29363 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability | Critical | 9.8 | No | No | RCE |
| CVE-2023-32014 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability | Critical | 9.8 | No | No | RCE |
| CVE-2023-32015 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability | Critical | 9.8 | No | No | RCE |
| CVE-2023-32030 | .NET and Visual Studio Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
| CVE-2023-32032 | .NET and Visual Studio Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
| CVE-2023-33135 | .NET and Visual Studio Elevation of Privilege Vulnerability | Important | 7.3 | No | No | EoP |
| CVE-2023-33126 | .NET and Visual Studio Remote Code Execution Vulnerability | Important | 7.3 | No | No | RCE |
| CVE-2023-33128 | .NET and Visual Studio Remote Code Execution Vulnerability | Important | 7.3 | No | No | RCE |
| CVE-2023-29331 | .NET Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
| CVE-2023-29326 | .NET Framework Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-24895 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-27909 * | AutoDesk: CVE-2023-27909 Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK 2020 or prior | Important | 7.8 | No | No | RCE |
| CVE-2023-27910 * | AutoDesk: CVE-2023-27910 stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior | Important | 7.8 | No | No | RCE |
| CVE-2023-27911 * | AutoDesk: CVE-2023-27911 Heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior | Important | 7.8 | No | No | RCE |
| CVE-2023-21565 | Azure DevOps Server Spoofing Vulnerability | Important | 7.1 | No | No | Spoofing |
| CVE-2023-21569 | Azure DevOps Server Spoofing Vulnerability | Important | 5.5 | No | No | Spoofing |
| CVE-2023-29355 | DHCP Server Service Information Disclosure Vulnerability | Important | 5.3 | No | No | Info |
| CVE-2023-25652 * | GitHub: CVE-2023-25652 “git apply –reject” partially-controlled arbitrary file write | Important | 7.5 | No | No | N/A |
| CVE-2023-25815 * | GitHub: CVE-2023-25815 Git looks for localized messages in an unprivileged place | Important | 3.3 | No | No | N/A |
| CVE-2023-29007 * | GitHub: CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit` | Important | 7.8 | No | No | N/A |
| CVE-2023-29011 * | GitHub: CVE-2023-29011 The config file of `connect.exe` is susceptible to malicious placing | Important | 7.5 | No | No | N/A |
| CVE-2023-29012 * | GitHub: CVE-2023-29012 Git CMD erroneously executes `doskey.exe` in current directory, if it exists | Important | 7.2 | No | No | N/A |
| CVE-2023-29367 | iSCSI Target WMI Provider Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-24896 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | Important | 5.4 | No | No | XSS |
| CVE-2023-33145 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | Important | 6.5 | No | No | Info |
| CVE-2023-32029 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-33133 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-33137 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-28310 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important | 8 | No | No | RCE |
| CVE-2023-32031 | Microsoft Exchange Server Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
| CVE-2023-29373 | Microsoft ODBC Driver Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
| CVE-2023-33146 | Microsoft Office Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-33140 | Microsoft OneNote Spoofing Vulnerability | Important | 6.5 | No | No | Spoofing |
| CVE-2023-33131 | Microsoft Outlook Spoofing Vulnerability | Important | 6.5 | No | No | Spoofing |
| CVE-2023-32017 | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-32024 | Microsoft Power Apps Spoofing Vulnerability | Important | 3 | No | No | Spoofing |
| CVE-2023-33129 | Microsoft SharePoint Denial of Service Vulnerability | Important | 6.5 | No | No | DoS |
| CVE-2023-33142 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Important | 6.5 | No | No | EoP |
| CVE-2023-33130 | Microsoft SharePoint Server Spoofing Vulnerability | Important | 7.3 | No | No | Spoofing |
| CVE-2023-33132 | Microsoft SharePoint Server Spoofing Vulnerability | Important | 6.3 | No | No | Spoofing |
| CVE-2023-29372 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
| CVE-2023-29346 | NTFS Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
| CVE-2023-29337 | NuGet Client Remote Code Execution Vulnerability | Important | 7.1 | No | No | RCE |
| CVE-2023-29362 | Remote Desktop Client Remote Code Execution Vulnerability | Important | 8.8 | No | No | RCE |
| CVE-2023-29369 | Remote Procedure Call Runtime Denial of Service Vulnerability | Important | 6.5 | No | No | DoS |
| CVE-2023-29353 | Sysinternals Process Monitor for Windows Denial of Service Vulnerability | Important | 5.5 | No | No | DoS |
| CVE-2023-33144 | Visual Studio Code Spoofing Vulnerability | Important | 5 | No | No | Spoofing |
| CVE-2023-33139 | Visual Studio Information Disclosure Vulnerability | Important | 7.8 | No | No | Info |
| CVE-2023-29359 | Win32k Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
| CVE-2023-29364 | Windows Authentication Elevation of Privilege Vulnerability | Important | 7 | No | No | EoP |
| CVE-2023-32010 | Windows Bus Filter Driver Elevation of Privilege Vulnerability | Important | 7 | No | No | EoP |
| CVE-2023-29361 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important | 7 | No | No | EoP |
| CVE-2023-32009 | Windows Collaborative Translation Framework Elevation of Privilege Vulnerability | Important | 8.8 | No | No | EoP |
| CVE-2023-32012 | Windows Container Manager Service Elevation of Privilege Vulnerability | Important | 6.3 | No | No | EoP |
| CVE-2023-24937 | Windows CryptoAPI Denial of Service Vulnerability | Important | 5.5 | No | No | DoS |
| CVE-2023-24938 | Windows CryptoAPI Denial of Service Vulnerability | Important | 5.5 | No | No | DoS |
| CVE-2023-32020 | Windows DNS Spoofing Vulnerability | Important | 3.7 | No | No | Spoofing |
| CVE-2023-29358 | Windows GDI Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
| CVE-2023-29366 | Windows Geolocation Service Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-29351 | Windows Group Policy Elevation of Privilege Vulnerability | Important | 8.1 | No | No | EoP |
| CVE-2023-32018 | Windows Hello Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-32016 | Windows Installer Information Disclosure Vulnerability | Important | 5.5 | No | No | Info |
| CVE-2023-32011 | Windows iSCSI Discovery Service Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
| CVE-2023-32019 | Windows Kernel Information Disclosure Vulnerability | Important | 4.7 | No | No | Info |
| CVE-2023-29365 | Windows Media Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-29370 | Windows Media Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-29352 | Windows Remote Desktop Security Feature Bypass Vulnerability | Important | 6.5 | No | No | SFB |
| CVE-2023-32008 | Windows Resilient File System (ReFS) Remote Code Execution Vulnerability | Important | 7.8 | No | No | RCE |
| CVE-2023-32022 | Windows Server Service Security Feature Bypass Vulnerability | Important | 7.6 | No | No | SFB |
| CVE-2023-32021 | Windows SMB Witness Service Security Feature Bypass Vulnerability | Important | 7.1 | No | No | SFB |
| CVE-2023-29368 | Windows TCP/IP Driver Elevation of Privilege Vulnerability | Important | 7 | No | No | EoP |
| CVE-2023-29360 | Windows TPM Device Driver Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
| CVE-2023-29371 | Windows Win32k Elevation of Privilege Vulnerability | Important | 7.8 | No | No | EoP |
| CVE-2023-33141 | Yet Another Reverse Proxy (YARP) Denial of Service Vulnerability | Important | 7.5 | No | No | DoS |
| CVE-2023-24936 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability | Moderate | 8.1 | No | No | RCE |
| CVE-2023-33143 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | Moderate | 7.5 | No | No | EoP |
| CVE-2023-29345 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | Low | 6.1 | No | No | SFB |
| CVE-2023-3079 * | Chromium: CVE-2023-3079 Type Confusion in V8 | High | N/A | No | Yes | RCE |
| CVE-2023-2929 * | Chromium: CVE-2023-2929 Out of bounds write in Swiftshader | High | N/A | No | No | RCE |
| CVE-2023-2930 * | Chromium: CVE-2023-2930 Use after free in Extensions | High | N/A | No | No | RCE |
| CVE-2023-2931 * | Chromium: CVE-2023-2931 Use after free in PDF | High | N/A | No | No | RCE |
| CVE-2023-2932 * | Chromium: CVE-2023-2932 Use after free in PDF | High | N/A | No | No | RCE |
| CVE-2023-2933 * | Chromium: CVE-2023-2933 Use after free in PDF | High | N/A | No | No | RCE |
| CVE-2023-2934 * | Chromium: CVE-2023-2934 Out of bounds memory access in Mojo | High | N/A | No | No | RCE |
| CVE-2023-2935 * | Chromium: CVE-2023-2935 Type Confusion in V8 | High | N/A | No | No | RCE |
| CVE-2023-2936 * | Chromium: CVE-2023-2936 Type Confusion in V8 | High | N/A | No | No | RCE |
| CVE-2023-2937 * | Chromium: CVE-2023-2937 Inappropriate implementation in Picture In Picture | Medium | N/A | No | No | N/A |
| CVE-2023-2938 * | Chromium: CVE-2023-2938 Inappropriate implementation in Picture In Picture | Medium | N/A | No | No | N/A |
| CVE-2023-2939 * | Chromium: CVE-2023-2939 Insufficient data validation in Installer | Medium | N/A | No | No | N/A |
| CVE-2023-2940 * | Chromium: CVE-2023-2940 Inappropriate implementation in Downloads | Medium | N/A | No | No | N/A |
| CVE-2023-2941 * | Chromium: CVE-2023-2941 Inappropriate implementation in Extensions API | Low | N/A | No | No | N/A |
Let’s talk about CVE-2023-32031 for a second. This vulnerability, in case you didn’t already know, is actually a bypass of both CVE-2022-41082 and CVE-2023-21529.
Remember that the former was listed as being under active exploit, and this specific flaw exists within the Command class.
The issue started from the lack of proper validation of user-supplied data, which can result in the deserialization of untrusted data.
Even though this does require the attacker to have an account on the Exchange server, successful exploitation could lead to executing code with SYSTEM privileges.
Looking at CVE-2023-29363/32014/32015, we can tell that these three bugs look identical on paper, and all are listed as a CVSS 9.8.
They allowed a remote, unauthenticated attacker to execute code on an affected system where the message queuing service is running in a Pragmatic General Multicast (PGM) Server environment.
While not enabled by default, PGM isn’t an uncommon configuration, so we do hope these bugs get fixed before any active exploitation starts.
There are only two other Critical-rated bugs in this month’s release, with the first appearing to be all supported versions of .NET, .NET Framework, and Visual Studio.
In fact, it’s an open-and-own sort of exploit, but judging by the Critical rating, it appears there are no warning dialogs when opening the dodgy file.
The second Critical-rated fix for June addresses a Denial-of-Service (DoS) bug in the Hyper-V server, so the Critical rating implies a guest OS could potentially shut down the host OS, or at least cause some form of a DoS condition.
The June 2023 Patch Tuesday rollout includes fixes for four security feature bypass (SFB) bugs, and two of these involve bypassing the check RPC procedure.
If left unchecked, they could allow the execution of RCE procedures that should otherwise be restricted when making calls to an SMB server.
Know that the bug in the RDP requires someone open a specially crafted file, but if they can convince the user to take that action, the attacker could bypass certificate or private key authentication when establishing a remote desktop protocol session.
Let’s also mention the final SFB patch, which is the Low-severity bug in Edge that could allow attackers to bypass the permissions dialog feature when clicking on a URL.
Going through the remaining DoS fixes for June, the vast majority offer no additional details, so it’s not clear whether an attack would only impact the component or the entire system.
These above-mentioned bugs in the CryptoAPI service may impact authentication actions, but that’s just speculation based on the component.
Was this article helpful to you? Share your opinion in the comments section below.
