Critical security patches released by Microsoft, Adobe and other major software companies

Microsoft's March update is now officially available, with 71 fixes across software products including Windows, Office, Exchange and Defender.

Of the 71 patches, three are rated critical and 68 important. Although none of the vulnerabilities is reported as actively exploited, three were publicly known at the time of release.

Microsoft also addressed 21 flaws separately in its Chromium-based Microsoft Edge browser earlier this month.

All three critical vulnerabilities fixed this month are remote-code-execution flaws affecting HEVC Video Extensions (CVE-2022-22006), Microsoft Exchange Server (CVE-2022-23277) and VP9 Video Extensions (CVE-2022-24501).

The Microsoft Exchange Server vulnerability, reported by researcher Markus Wulftange, is also notable because an attacker must authenticate before exploiting the server.

"An attacker exploiting this vulnerability could target server accounts for arbitrary or remote code execution," the Windows maker said. "As an authenticated user, an attacker could try to trigger malicious code in the context of the server account through a network call."

"The critical CVE-2022-23277 vulnerability should also be a concern," said Kevin Breen, director of cyber-threat research at Immersive Labs. "Although authentication is required, this vulnerability affecting on-premises Exchange Servers could potentially be used during lateral movement to reach a part of the environment that offers opportunities for business email compromise or theft of email data."

The three zero-day bugs patched by Microsoft are:

• CVE-2022-24512 (CVSS score: 6.3) — .NET and Visual Studio remote-code-execution vulnerability
• CVE-2022-21990 (CVSS score: 8.8) — Remote Desktop Client remote-code-execution vulnerability
• CVE-2022-24459 (CVSS score: 7.8) — Windows Fax and Scan Services elevation-of-privilege vulnerability

Microsoft also classified CVE-2022-21990 as exploitation more likely because a proof-of-concept (PoC) exploit is publicly available, making prompt patching essential to prevent potential attacks.

Other important flaws include remote-code-execution issues in Windows SMBv3 Client/Server, Microsoft Office and Paint 3D, along with privilege-escalation flaws in Xbox Live Auth Manager, Microsoft Defender for IoT (Internet of Things) and Azure Site Recovery.

Overall, the patches close 29 remote-code-execution vulnerabilities, 25 elevation-of-privilege vulnerabilities, six information-disclosure vulnerabilities, four denial-of-service vulnerabilities, three security-feature-bypass vulnerabilities, three spoofing vulnerabilities and one tampering vulnerability.

In addition to Microsoft, other vendors have released security updates to fix vulnerabilities, including:

• Adobe
• AMD
• Android
• Cisco
• Citrix
• HP
• Intel
• Juniper Networks
• Linux distributions Oracle Linux, Red Hat and SUSE
• Mozilla Firefox and Firefox ESR
• SAP
• Schneider Electric
• Siemens