Microsoft Releases September 2020 Security Patches For 129 Flaws

Of the 129 bugs spanning its various products — Microsoft
Windows, Edge browser, Internet Explorer, ChakraCore, SQL Server,
Exchange Server, Office, ASP.NET, OneDrive, Azure DevOps, Visual
Studio, and Microsoft Dynamics — that received new patches, 23 are
listed as critical, 105 are important, and one is moderate in
severity.

Unlike the past few months, none of the security vulnerabilities
the tech giant patched in September are listed as being publicly
known or under active attack at the time of release or at least not
in knowledge of Microsoft.

“A remote code execution vulnerability exists in Microsoft
Exchange software when the software fails to properly handle
objects in memory,” Microsoft explains. “An attacker could then
install programs; view, change, or delete data; or create new
accounts.”

Microsoft also patched two critical remote code execution flaws
in Windows Codecs Library; both exist in the way that Microsoft
Windows Codecs Library handles objects in memory, but while one
(CVE-2020-1129^[2]) could be exploited to
obtain information to compromise the user’s system further, the
other (CVE-2020-1319^[3]) could be used to take
control of the affected system.

Besides these, two remote code execution flaws affect the
on-premises implementation of Microsoft Dynamics 365, but both
require the attacker to be authenticated.

Microsoft also patched six critical remote code execution
vulnerabilities in SharePoint and one in SharePoint Server. While
exploiting the vulnerability in SharePoint Server requires
authentication, other flaws in SharePoint do not.

Other critical flaws the tech giant patched this month reside in
Windows, Windows Media Audio Decoder, Windows Text Service Module,
Windows Camera Codec Pack, Visual Studio, Scripting Engine,
Microsoft COM for Windows, Microsoft Browser, and Graphics Device
Interface.

Vulnerabilities marked as important reside in Windows, Active
Directory, Active Directory Federation Services (ADFS), Internet
Explorer Browser Helper, Jet Database Engine, ASP.NET Core,
Dynamics 365, Excel, Graphics Component, Office, Office SharePoint,
SharePoint Server, SharePoint, Word, OneDrive for Windows,
Scripting Engine, Visual Studio, Win32k, Windows Defender
Application Control, Windows DNS, and more.

Most of these vulnerabilities allow information disclosure, the
elevation of privilege, and cross-Site Scripting. Some also lead to
remote code execution attacks. In contrast, others allow security
feature bypass, spoofing, tampering, and denial of service
attacks.

Windows users and system administrators are highly advised to
apply the latest security patches as soon as possible to keep
cybercriminals and hackers away from taking control of their
computers.

For installing security updates, head on to Settings → Update &
security → Windows Update → Check for updates or install the
updates manually.