Patch Tuesday, January 2020
Microsoft's monthly security release, Tuesday, January 14, 2020. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 1 critical · 3 exploited · 3 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 1 critical · 3 exploited · 3 with public exploit code
- 9.8CriticalJan 14, 2020Microsoft .NET Framework Code / command injectionCVE-2020-0646Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.Exploited99% likelyExploit codeExploit-DB · MetasploitDetection
- 8.1HighJan 14, 2020Microsoft Windows Crypto / certificateCVE-2020-0601Windows Cryptographic Services An attacker gains the ability to create a malicious certificate that appears to be trusted by a Windows system. Install the Microsoft Windows Security Update (KB4534321) to address this vulnerability.Exploited89% likelyExploit codeExploit-DB
- 7.8HighJan 14, 2020Microsoft Update Notification Manager Path traversal / file handlingCVE-2020-0638Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.Exploited2.4% likelyExploit code
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.