September 2023 Patch Tuesday

[katos]

Quick summary:

• ⁠Windows: 61 vulnerabilities:
⁠• ⁠two zero-days: CVE-2023-36761 and CVE-2023-36802
⁠• ⁠five critical: CVE-2023-38148, CVE-2023-36796, CVE-2023-36793, CVE-2023-36792, CVE-2023-29332
• ⁠Android: two sets of fixed vulnerabilities, one zero-day CVE-2023-35674
• ⁠Chrome: 9 vulnerabilities
• ⁠Ivanti: seven critical vulnerabilities
• ⁠SCADA: zero-day CVE-2023-39476 (CVSS 9.8)
• ⁠Citrix: CVE-2023-3519, part of extensive malware campaign
• ⁠Splunk: several serious vulnerabilities
• ⁠Notepad++: four critical vulnerabilities
• ⁠Juniper: four serious vulnerabilities
• ⁠Apple: two zero-daysCVE-2023-41064 and CVE-2023-41061
• ⁠Skype: vulnerability revealing user's IP address
• ⁠WinRAR: serious vulnerabilities CVE-2023-40477 and CVE-2023-38831
• ⁠Intel: CVE-2022-40982, aka "Downfall"
• ⁠AMD: CVE-2023-20569 aka “Inception"
• ⁠Siemens: over 30 vulnerabilities

Other sources:

Zero Day Initiative. https://www.zerodayinitiative.com/blog/2023/9/12/the-september-2023-security-update-review

Bleeping Computer: https://www.bleepingcomputer.com/news/microsoft/windows-11-kb5030219-cumulative-update-released-with-24-fixes-changes/

MSRC: https://msrc.microsoft.com/update-guide/vulnerability

[katos]

This is an evolving thread, please feel free to update and/or amend

[katos]

Online reports are suggesting that patching is taking a lot longer than usual to apply and restart. Not seeing it myself just yet but worth baring in mind!

tankerkiller125 not sure if you’re seeing anything of the sort?

[BillyScott]

katos I am not seeing this issue on any of our devices or servers.

[katos]

BillyScott we’ve not seen it on any of ours either.

[tankerkiller125]

I haven't seen anything with slow updates either.