The Windows December 2023 security updates fix a 0-day vulnerability

[harlan4096]

Microsoft released security updates for all supported Windows operating systems and other company products on the December 2023 Patch Day. The company fixed 36 unique Microsoft product vulnerabilities and six non Microsoft product vulnerabilities on the last Patch Day of the year 2023.

It is a smaller Patch Day that fixes three critical security issues in all supported Windows client and server products. The update fixes one publicly disclosed 0-day vulnerability. Listed as CVE-2023-20588, it affects devices with AMD processors only.

Our overview is designed to be a resource for system administrators and home users alike. It includes information about all major security updates that Microsoft released. You find links to support pages and resources, the list of known issues, direct download links and more listed below.

Check out the November 2023 Security update overview here.

Microsoft Windows Security Updates: November 2023

Here is a link to an Excel spreadsheet that lists information about the released security updates on the December 2023 Microsoft Patch Day. Follow this link to download an archive file that contains the spreadsheet:  Microsoft Windows security updates December 2023

Executive Summary

• Windows 11 version 21H2 is no longer supported. Upgrades to Windows 11 version 22H2 are available.
  
• Windows Copilot is now available on Windows 10 devices. Microsoft's March 2023 announced change to app pinning and app defaults is now in effect. It applies to Microsoft apps and third-party apps, according to the company.
  
• Windows clients with issues are: Windows 10 version 1809, Windows 10 version 21H2 and 22H2, Windows 11 version 21H2, 22H2 and 23H2
  
• Windows Server clients: Windows Server 2008 and 2008 R2, Windows Server 2019
  

Each supported version of Windows and their critical vulnerabilities are listed below.

• Windows 10 version 22H2: 15 vulnerabilities, 3 critical and 12 important.
  • Internet Connection Sharing (ICS) Remote Code Execution Vulnerability -- CVE-2023-35630
    
  • Windows MSHTML Platform Remote Code Execution Vulnerability -- CVE-2023-35628
    
  • Internet Connection Sharing (ICS) Remote Code Execution Vulnerability -- CVE-2023-35641
    
• Windows 11 version 22H2:  17 vulnerabilities, 3 critical and 14 important
  • same as Windows 10 version 22H2
    
• Windows 11 version 23H2:  18 vulnerabilities, 3 critical and 15 important
  • same as Windows 10 version 22H2
    

Windows Server products

• Windows Server 2008 R2 (extended support only): 15 vulnerabilities: 3 critical and 12 important
  • Internet Connection Sharing (ICS) Remote Code Execution Vulnerability -- CVE-2023-35630
    
  • Windows MSHTML Platform Remote Code Execution Vulnerability -- CVE-2023-35628
    
  • Internet Connection Sharing (ICS) Remote Code Execution Vulnerability -- CVE-2023-35641
    
• Windows Server 2012 R2 (extended support only): 61 vulnerabilities: 11 critical and 50 important
  • Not published (yet)
    
• Windows Server 2016: 17 vulnerabilities: 3 critical and 14 important
  • same as Windows Server 2008 R2
    
• Windows Server 2019: 19 vulnerabilities: 3 critical and 16 important
  • same as Windows Server 2008 R2
    
•  Windows Server 2022: 18 vulnerabilities: 3 critical and 15 important.
  • same as Windows Server 2008 R2
    

...

Continue Reading