The most critical updates for this “Patch Tuesday” come from Firefox and Adobe. While Microsoft addresses 70 vulnerabilities in its February 2022 Patch Tuesday release, none of them are ranked as critical. Firefox and Adobe however have fixed a few issues that could be qualified as critical.

公开披露的计算机安全缺陷在常见漏洞和暴露（CVE）数据库中列出。它的目标是使在单独的漏洞功能（工具，数据库和服务）上共享数据变得更加容易。让我们看一下那些跳下来的人。

Firefox

Mozilla修复了其Firefox浏览器中的十二个安全漏洞。两个最重要的都是权限问题：

  • CVE-2022-22753维护（Updater）服务中存在一个检查时间的错误时间错误，可以滥用以授予用户写对任意目录的访问权限。这本可以用来升级到系统访问。此错误仅影响窗户上的Firefox。其他操作系统不受影响。
  • CVE-2022-22754If a user installs an extension of a particular type, the extension could have auto-updated itself and, while doing so, bypass the prompt which grants the new version the new requested permissions.

Two other vulnerabilities were classified as high. Those two are both memory safety bugs that with enough effort could have been exploited to run arbitrary code. These vulnerabilities were found by Mozilla developers.

Adobe

Adobereleased updates to fix 17 CVEs affecting Premiere Rush, Illustrator, Photoshop, After Effects, and Creative Cloud Desktop. Of these 17 vulnerabilities, five are rated as critical.

  • CVE-2022-23203一个缓冲区溢出漏洞，可能导致Photoshop 2021中的任意代码执行，以及用于Windows和MacOS的Photoshop 2022。
  • CVE-2022-23186一个不合时宜的写入漏洞，可能导致插画家2021和插图仪2022中的插图代码执行。
  • CVE-2022-23188A buffer overflow vulnerability that could lead to arbitrary code execution in Illustrator 2021 and Illustrator 2022 for Windows and macOS.
  • CVE-2022-23200An out-of-bounds write vulnerability that could lead to arbitrary code execution in Adobe After Effects 18.4.3, 22.1.1 and earlier versions for Windows and macOS.
  • CVE-2022-23202不受控制的搜索路径元素漏洞可能会导致Creative Cloud Desktop Application Installer 2.7.0.13和Windows上更早版本中的任意代码执行。

微软

即使没有Microsoft漏洞被列为关键，但仍有一些值得关注的地方。

  • CVE-2022-21989Windows内核高度漏洞。根据微软咨询, successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. But in such a case, a successful attack could be performed from a low privilegeAppContainer。攻击者可以比AppContainer执行环境更高的完整性级别提升其特权，并执行代码或访问资源。
  • CVE-2022-21996Win32k海拔特权漏洞列表ed as more likely to be exploited. The exploitation is known to be easy. The attack may be initiated remotely, but requires simple authentication for exploitation.
  • CVE-2022-22005Microsoft SharePoint Server远程代码执行漏洞。攻击者必须经过身份验证，并拥有Page Creation的权限，以便能够利用此漏洞。但是，经常为身份验证的用户提供此权限。
  • CVE-2022-21984Windows DNS服务器远程代码执行漏洞。仅当启用动态更新时，服务器受到影响，但这是一种相对常见的配置。攻击者可能会控制您DNS如果您在环境中设置此设置，则执行具有提升特权的代码。

Given the amount of available stolen login credentials, organizations shouldn’t disregard the vulnerabilities that require authentication, especially where it concerns public-facing servers. We hope this quick summary makes it easier for you to prioritize your updating jobs.

保持安全，大家！