MS Family April 2024 Routine Security Update Advisory
Overview
Microsoft (https://www.microsoft.com) has released a security update that fixes vulnerabilities in products it has been made. users of affected products are advised to update to the latest version.
Affected Products
Windows 11 23H2,
Windows 11 v22H2,
Windows 11 v21H2
Windows 10 22H2
Windows 10 21H2
Windows Server 2022 23H2 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server 2019
Windows Server 2016
Microsoft Office
Microsoft SharePoint
Microsoft .NET
Microsoft .NET Framework
Microsoft Visual Studio
Microsoft SQL Server
Microsoft Azure
Microsoft Defender for IoT
Resolved Vulnerabilities
1 vulnerability rated Critical and 12 vulnerabilities rated Important were found.
Microsoft Edge (Chromium-based) Family
Chromium: Out-of-bounds memory access in V8 (CVE-2024-3159)
Chromium: Use after free (UaF) in Bookmarks (CVE-2024-3158)
Chromium: Improper Implementation in V8 (CVE-2024-3156)
Microsoft Edge (based on Chromium) Spoofing Vulnerability (CVE-2024-29981, CVE-2024-29057)
Microsoft Edge (based on Chromium) Webview2 Spoofing Vulnerability (CVE-2024-29049)
Chromium: Type Confusion in WebAssembly (CVE-2024-2887)
Chromium: Use after free (UaF) in WebCodecs (CVE-2024-2886)
Chromium: Use after free (UaF) in Dawn (CVE-2024-2885)
Chromium: Use after free (UaF) in ANGLE (CVE-2024-2883)
Chromium: Improper implementation in iOS (CVE-2024-2631, CVE-2024-2630)
Chromium: Malformed Security UI on iOS (CVE-2024-2629)
Chromium: Improper Implementation in Downloads (CVE-2024-2628)
Chromium: Use after free (UaF) in Canvas (CVE-2024-2627)
Chromium: Read out of scope in Swiftshader (CVE-2024-2626)
Chromium: Object Lifecycle Issue in V8 (CVE-2024-2625)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2024-26247, CVE-2024-26246, CVE-2024-26163)
Chromium: Use after free (UaF) in Performance Manager (CVE-2024-2400)
Azure Family
Azure CycleCloud Elevation of Privilege Vulnerability (CVE-2024-29993)
Azure SDK family
Azure Identity Library for .NET Information Disclosure Vulnerability (CVE-2024-29992)
Microsoft Azure Kubernetes Service Suite
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability (CVE-2024-29990)
Azure Monitor Suite
Azure Monitor Agent Elevation of Privilege Vulnerability (CVE-2024-29989)
Internet Shortcut Files family
SmartScreen Prompt Security Feature Bypass Vulnerability (CVE-2024-29988)
SQL Server Family
Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerabilities (CVE-2024-29985, CVE-2024-29984, CVE-2024-29983, CVE-2024-29982, CVE-2024-29048, CVE-2024-29047, Cve-2024-29046, cve-2024-29045, cve-2024-29044, cve-2024-29043, cve-2024-28915, cve-2024-28914, cve-2024-28913, cve-2024-28912, cve-2024-28911, cve-2024-28910, cve-2024-28909, Cve-2024-28908, cve-2024-28906, cve-2024-28945, cve-2024-28944, cve-2024-28944, cve-2024-28943, cve-2024-28942, cve-2024-28941, cve-2024-28940, cve-2024-28939, cve-2024-28938, Cve-2024-28937, cve-2024-28936, cve-2024-28935, cve-2024-28934, cve-2024-28933, cve-2024-28932, cve-2024-28931, cve-2024-28930, cve-2024-28929, cve-2024-28927, cve-2024-28926)
Windows Distributed File System (DFS) Family
Windows Distributed File System (DFS) Remote Code Execution Vulnerability (CVE-2024-29066)
Windows Distributed File System (DFS) Information Disclosure Vulnerability (CVE-2024-26226)
Role: Windows Hyper-V Family
Windows Hyper-V Denial of Service Vulnerability (CVE-2024-29064)
Azure AI Search Family
Azure AI Search Information Disclosure Vulnerability (CVE-2024-29063)
Windows Secure Boot Family
Secure Boot Security Feature Bypass Vulnerabilities (CVE-2024-29062, CVE-2024-29061, CVE-2024-28925, CVE-2024-28924, CVE-2024-28923, CVE-2024-28922, CVE-2024-28921, CVE-2024-28920, CVE-2024-28919, CVE-2024-28903, CVE-2024-28898, Cve-2024-28897, cve-2024-28896, cve-2024-26250, cve-2024-26240, cve-2024-26194, cve-2024-26189, cve-2024-26180, cve-2024-26175, cve-2024-26171, cve-2024-26168, cve-2024-20689, cve-2024-20688, cve-2024-20669, cve-2023-24932)
Lenovo: Stack Buffer Overflow in LenovoBT.efi (CVE-2024-23594)
Lenovo: Boot Manager Initialization and Jump to UEFI Shell (CVE-2024-23593)
.NET Framework Family
.NET Framework Information Leakage Vulnerability (CVE-2024-29059)
Windows Authentication Methods Family
Windows Authentication Privilege Elevation Vulnerabilities (CVE-2024-29056, CVE-2024-21447)
Microsoft Defender for IoT Family
Microsoft Defender for IoT Privilege Escalation Vulnerabilities (CVE-2024-29055, CVE-2024-29054, CVE-2024-29053, CVE-2024-21324)
Microsoft Defender for IoT Remote Code Execution Vulnerabilities (CVE-2024-21323, CVE-2024-21322)
Windows Storage Suite
Windows Storage Elevation of Privilege Vulnerability (CVE-2024-29052)
Windows Cryptographic Services Family
Windows Cryptographic Services Remote Code Execution Vulnerability (CVE-2024-29050)
Windows Cryptographic Services Security Feature Bypass Vulnerability (CVE-2024-26228)
Azure Arc Family
Azure Arc-enabled Kubernetes Extended Clusters with Kubernetes – Scope Elevation of Privilege Vulnerability (CVE-2024-28917)
XBox Crypto Graphic Services Suite
XBox Game Services Elevation of Privilege Vulnerability (CVE-2024-28916)
Microsoft Brokering File System Family
Microsoft Brokering File System Privilege Escalation Vulnerabilities (CVE-2024-28907, CVE-2024-28905, CVE-2024-28904, CVE-2024-26213)
Windows Remote Access Connection Manager Suite
Windows Remote Access Connection Manager Information Exfiltration Vulnerabilities (CVE-2024-28902, CVE-2024-28901, CVE-2024-28900, CVE-2024-26255, CVE-2024-26217, CVE-2024-26207)
Windows Telephony Server Elevation of Privilege Vulnerability (CVE-2024-26239, CVE-2024-26230)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVE-2024-26211)
Microsoft Office Excel Suite
Microsoft Excel Remote Code Execution Vulnerability (CVE-2024-26257)
Windows Compressed Folder Suite
Libarchive Remote Code Execution Vulnerability (CVE-2024-26256)
Windows Virtual Machine Bus Family
Microsoft Virtual Machine Bus (VMBus) Denial of Service Vulnerability (CVE-2024-26254)
Windows Internet Connection Sharing (ICS) Family
Windows rndismp6.sys Remote Code Execution Vulnerability (CVE-2024-26253, CVE-2024-26252)
Microsoft Office SharePoint Suite
Microsoft SharePoint Server Spoofing Vulnerability (CVE-2024-26251)
Windows Kerberos Family
Windows Kerberos Elevation of Privilege Vulnerability (CVE-2024-26248)
Windows Kerberos Denial of Service Vulnerability (CVE-2024-26183)
Windows Kerberos Security Feature Bypass Vulnerability (CVE-2024-21427)
Windows Kernel Family
Windows SMB Elevation of Privilege Vulnerability (CVE-2024-26245)
Windows CSC Service Elevation of Privilege Vulnerability (CVE-2024-26229)
Windows Kernel Privilege Escalation Vulnerabilities (CVE-2024-26218, CVE-2024-20693)
Microsoft WDAC OLE DB provider for SQL family of products
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerabilities (CVE-2024-26244, CVE-2024-26210)
Windows USB Print Driver Family
Windows USB Print Driver Privilege Escalation Vulnerability (CVE-2024-26243)
Windows Telephony Server Family
Windows Telephony Server Elevation of Privilege Vulnerability (CVE-2024-26242)
Windows Win32K – ICOMP Family
Win32k Privilege Escalation Vulnerability (CVE-2024-26241)
Windows Defender Credential Guard Family
Windows Defender Remote Credential Guard Privilege Escalation Vulnerability (CVE-2024-26237)
Windows Update Stack Family
Windows Update Stack Privilege Escalation Vulnerability (CVE-2024-26236, CVE-2024-26235)
Windows Proxy Driver Family
Proxy Driver Spoofing Vulnerability (CVE-2024-26234)
Role: DNS Server Family
Windows DNS Server Remote Code Execution Vulnerabilities (CVE-2024-26233, CVE-2024-26231, CVE-2024-26227, CVE-2024-26227, CVE-2024-26224, CVE-2024-26223, CVE-2024-26222, CVE-2024-26221)
Windows Message Queuing Suite
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVE-2024-26232)
Windows Mobile Hotspot family
Windows Mobile Hotspot Information Disclosure Vulnerability (CVE-2024-26220)
Windows HTTP.sys Family
HTTP.sys Denial of Service Vulnerability (CVE-2024-26219)
Windows File Server Resource Management Service family
Windows File Server Resource Manager Service Elevation of Privilege Vulnerability (CVE-2024-26216)
Windows DHCP Server Family
DHCP Server Service Denial of Service Vulnerabilities (CVE-2024-26215, CVE-2024-26212)
DHCP Server Service Remote Code Execution Vulnerability (CVE-2024-26202, CVE-2024-26195)
Microsoft WDAC ODBC Driver Suite
Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability (CVE-2024-26214)
Windows Local Security Authority Subsystem Service (LSASS) Suite
Microsoft Local Security Authority Subsystem Service (LSASS) Information Disclosure Vulnerability (CVE-2024-26209)
Windows Message Queuing Family
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVE-2024-26208)
Windows Routing and Remote Access Service (RRAS) Suite
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerabilities (CVE-2024-26205, CVE-2024-26200, CVE-2024-26179)
Microsoft Intune Suite
Microsoft Intune Linux Agent Elevation of Privilege Vulnerability (CVE-2024-26201)
Azure Migrate Suite
Azure Migrate Remote Code Execution (CVE-2024-26193)
Windows DWM Core Library Suite
Windows DWM Core Library Information Disclosure Vulnerability (CVE-2024-26172)
Microsoft Edge for Android Family
Microsoft Edge for Android Spoofing Vulnerability (CVE-2024-26167)
Microsoft Install Service Family
Microsoft Install Service Privilege Escalation Vulnerability (CVE-2024-26158)
Azure Compute Gallery Suite
Azure Compute Gallery Elevation of Privilege Vulnerability (CVE-2024-21424)
.NET and Visual Studio Family
.NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2024-21409)
Open Management Infrastructure Family
Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability (CVE-2024-21330)
Azure Connected Machine Agent family
Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVE-2024-21329)
Azure Private 5G Core family
Azure Private 5G Core Denial of Service Vulnerability (CVE-2024-20685)
Windows Remote Procedure Call family
Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVE-2024-20678)
Microsoft Office Outlook Suite
Outlook for Windows Spoofing Vulnerability (CVE-2024-20670)
Windows BitLocker Suite
BitLocker Security Feature Bypass Vulnerability (CVE-2024-20665)
Intel Family
Intel: Branch History Injection (BHI) (CVE-2022-2201)
Vulnerability Patches
The following product-specific Vulnerability Patches were made available in the 04/09/2024 Update. Please download and install them using the Windows Update feature or refer to the URLs in the product information below.
[1] (Korean) https://msrc.microsoft.com/update-guide/ko-kr/
[2] (English) https://msrc.microsoft.com/update-guide/en-us/
[3] https://msrc.microsoft.com/update-guide/ko-kr/releaseNote/2024-Apr