CVE-2024-43625

Use After Free (CWE-416)

Published: Nov 12, 2024

In this case, a successful attack could be performed from a low privilege Hyper-V guest. What privileges could be gained by an attacker who successfully exploited this vulnerability?

None of the following critical vulnerabilities below have been reported as being actively exploited or publicly disclosed: The following vulnerabilities have been reported as publicly disclosed, but not yet actively exploited :

Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:

Microsoft addressed 89 Common Vulnerabilities and Exposures (CVE’s) this month, 6 which were marked as zero-day vulnerabilities. The most critical Common Vulnerabilities and Exposures (CVE’s) are noted below:

Microsoft’s November Patch Tuesday release addresses 89 vulnerabilities in Windows, SQL Server, .NET and Microsoft Office — and three zero-day vulnerabilities ( CVE-2024-43451, CVE-2024-49019 and CVE-2024-49039 ) that mean a patch now recommendation for Windows platforms. Before you apply this Exchange Server update, we highly recommend a review of the reported header detection issues and mitigating factors.

With November Patch Tuesday, Microsoft addressed multiple serious vulnerabilities, including some publicly known and actively exploited flaws, affecting different services. CVE-2024-49039 (important; CVSS 8.8): A privilege escalation vulnerability in Windows Task Scheduler that was attacked before a fix could arrive.

On November 13, NSFOCUS CERT detected that Microsoft released a security update patch for November, which fixed 89 security issues, including Windows, Microsoft SQL Server, Microsoft Office, Azure, Open Source Software, Microsoft Visual Studio, System Center and other widely used products, including high-risk vulnerabilities such as privilege escalation vulnerability and remote code execution vulnerability. Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)