Today is Microsoft’s June 2023 Patch Tuesday, with security updates for 78 flaws, including 38 remote code execution vulnerabilities.

While thirty-eight RCE bugs were fixed, Microsoft only listed six flaws as ‘Critical,’ including denial of service attacks, remote code execution, and privilege elevation.

The number of bugs in each vulnerability category is listed below:

• 17 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 32 Remote Code Execution Vulnerabilities
• 5 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 10 Spoofing Vulnerabilities
• 1 Edge – Chromium Vulnerabilities

This list does not include sixteen Microsoft Edge vulnerabilities previously fixed on June 2nd, 2023.

This Patch Tuesday does not fix any zero-day vulnerabilities or actively exploited bugs, relieving some of the pressure usually felt by Windows admins during this day.

Notable vulnerabilities

While there are no zero-day vulnerabilities in the June 2023 Patch Tuesday, there are some notable flaws listed below:

Microsoft has also released numerous Microsoft Office updates for vulnerabilities, allowing threat actors to use malicious crafted Excel and OneNote documents to perform remote code execution.

These vulnerabilities are tracked as CVE-2023-32029 (Excel), CVE-2023-33133 (Excel), CVE-2023-33137 (Excel), CVE-2023-33140 (OneNote), CVE-2023-33131 (Outlook).

The OneNote and Outlook flaws require a user to click on a link in the malicious file or email.

Recent updates from other companies

Other vendors who released updates or advisories in June 2023 include:

• Cisco released security updates for Cisco AnyConnect and other products.
• Fortinet released new FortiOS firmware to fix an actively exploited Fortigate RCE zero-day.
• Google released security updates for Google Chrome to fix an actively exploited zero-day and the Android June 2023 updates.
• MOVEit released security updates for a zero-day actively exploited by the Clop ransomware gang in data theft attacks. A week later, they released another update for an RCE flaw found by Huntress Labs.
• SAP has released its June 2023 Patch Day updates.
• VMware released VMware ESXi updates to fix an actively exploited zero-day tracked as CVE-2023-20867.

The June 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the June 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.