KLA50315 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, bypass security restrictions, cause denial of service, spoof user interface.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Windows Group Policy can be exploited remotely to gain privileges.
2. An elevation of privilege vulnerability in Windows TPM Device Driver can be exploited remotely to gain privileges.
3. An information disclosure vulnerability in DHCP Server Service can be exploited remotely to obtain sensitive information.
4. A remote code execution vulnerability in Windows Pragmatic General Multicast (PGM) can be exploited remotely to execute arbitrary code.
5. A remote code execution vulnerability in Microsoft WDAC OLE DB provider for SQL Server can be exploited remotely to execute arbitrary code.
6. An elevation of privilege vulnerability in Windows GDI can be exploited remotely to gain privileges.
7. An elevation of privilege vulnerability in Windows Bus Filter Driver can be exploited remotely to gain privileges.
8. An information disclosure vulnerability in Windows Installer can be exploited remotely to obtain sensitive information.
9. A security feature bypass vulnerability in Windows Server Service can be exploited remotely to bypass security restrictions.
10. An elevation of privilege vulnerability in Windows Cloud Files Mini Filter Driver can be exploited remotely to gain privileges.
11. A remote code execution vulnerability in Microsoft PostScript Printer Driver can be exploited remotely to execute arbitrary code.
12. A remote code execution vulnerability in iSCSI Target WMI Provider can be exploited remotely to execute arbitrary code.
13. A remote code execution vulnerability in Windows Geolocation Service can be exploited remotely to execute arbitrary code.
14. A remote code execution vulnerability in Microsoft ODBC Driver can be exploited remotely to execute arbitrary code.
15. A denial of service vulnerability in Windows CryptoAPI can be exploited remotely to cause denial of service.
16. A remote code execution vulnerability in Remote Desktop Client can be exploited remotely to execute arbitrary code.
17. A denial of service vulnerability in Remote Procedure Call Runtime can be exploited remotely to cause denial of service.
18. A denial of service vulnerability in Windows Hyper-V can be exploited remotely to cause denial of service.
19. A security feature bypass vulnerability in Windows Remote Desktop can be exploited remotely to bypass security restrictions.
20. An elevation of privilege vulnerability in Windows Filtering Platform can be exploited remotely to gain privileges.
21. A remote code execution vulnerability in Windows Hello can be exploited remotely to execute arbitrary code.
22. A remote code execution vulnerability in Windows Media can be exploited remotely to execute arbitrary code.
23. An elevation of privilege vulnerability in Windows Collaborative Translation Framework can be exploited remotely to gain privileges.
24. A spoofing vulnerability in Windows DNS can be exploited remotely to spoof user interface.
25. An information disclosure vulnerability in Windows Kernel can be exploited remotely to obtain sensitive information.
26. A remote code execution vulnerability in Windows Resilient File System (ReFS) can be exploited remotely to execute arbitrary code.
27. An elevation of privilege vulnerability in GDI can be exploited remotely to gain privileges.
28. An elevation of privilege vulnerability in NTFS can be exploited remotely to gain privileges.
29. An elevation of privilege vulnerability in Windows Authentication can be exploited remotely to gain privileges.
30. An elevation of privilege vulnerability in Windows Container Manager Service can be exploited remotely to gain privileges.
31. A security feature bypass vulnerability in Windows SMB Witness Service can be exploited remotely to bypass security restrictions.
32. A denial of service vulnerability in Windows iSCSI Discovery Service can be exploited remotely to cause denial of service.

Original advisories

CVE-2023-29351

CVE-2023-29360

CVE-2023-29355

CVE-2023-32015

CVE-2023-29372

CVE-2023-29371

CVE-2023-32010

CVE-2023-32016

CVE-2023-32022

CVE-2023-29361

CVE-2023-32017

CVE-2023-29367

CVE-2023-29366

CVE-2023-29373

CVE-2023-24937

CVE-2023-29362

CVE-2023-29369

CVE-2023-32013

CVE-2023-29352

CVE-2023-29368

CVE-2023-29358

CVE-2023-32018

CVE-2023-29365

CVE-2023-29370

CVE-2023-32009

CVE-2023-32020

CVE-2023-32019

CVE-2023-32008

CVE-2023-32014

CVE-2023-29359

CVE-2023-29363

CVE-2023-24938

CVE-2023-29346

CVE-2023-29364

CVE-2023-32012

CVE-2023-32021

CVE-2023-32011

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-Server-2012

Microsoft-Windows-10

Microsoft-Windows-Server-2016

Microsoft-Windows-Server-2019

Microsoft-Windows-11

Microsoft-Remote-Desktop

CVE list

CVE-2023-29351 critical

CVE-2023-29360 critical

CVE-2023-29355 high

CVE-2023-32015 critical

CVE-2023-29372 critical

CVE-2023-29371 critical

CVE-2023-32010 high

CVE-2023-32016 high

CVE-2023-32022 critical

CVE-2023-29361 high

CVE-2023-32017 critical

CVE-2023-29367 critical

CVE-2023-29366 critical

CVE-2023-29373 critical

CVE-2023-24937 high

CVE-2023-29362 critical

CVE-2023-29369 high

CVE-2023-32013 high

CVE-2023-29352 high

CVE-2023-29368 high

CVE-2023-29358 critical

CVE-2023-32018 critical

CVE-2023-29365 critical

CVE-2023-29370 critical

CVE-2023-32009 critical

CVE-2023-32020 high

CVE-2023-32019 warning

CVE-2023-32008 critical

CVE-2023-32014 critical

CVE-2023-29359 critical

CVE-2023-29363 critical

CVE-2023-24938 high

CVE-2023-29346 critical

CVE-2023-29364 high

CVE-2023-32012 critical

CVE-2023-32021 high

CVE-2023-32011 critical

KB list

5027223

5027225

5027230

5027219

5027215

5027222

5027231

5027319

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Windows 10 Version 1809 for 32-bit SystemsWindows Server 2022Windows 11 version 21H2 for x64-based SystemsRemote Desktop client for Windows DesktopWindows 10 Version 1809 for x64-based SystemsWindows 10 Version 22H2 for x64-based SystemsWindows 11 version 21H2 for ARM64-based SystemsWindows Server 2022 (Server Core installation)Windows 11 Version 22H2 for x64-based SystemsWindows Server 2016Windows 10 Version 1607 for x64-based SystemsWindows Server 2016 (Server Core installation)Windows 10 Version 22H2 for ARM64-based SystemsWindows 10 Version 22H2 for 32-bit SystemsWindows Server 2012 R2Windows 10 Version 21H2 for ARM64-based SystemsWindows Server 2012 (Server Core installation)Windows Server 2012Windows 10 Version 21H2 for 32-bit SystemsWindows 10 Version 21H2 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows Server 2012 R2 (Server Core installation)Windows 10 Version 1809 for ARM64-based SystemsWindows Server 2019 (Server Core installation)Windows 11 Version 22H2 for ARM64-based SystemsWindows 10 for 32-bit SystemsWindows 10 for x64-based SystemsWindows Server 2019