Patch Tuesday, June 2021
Microsoft's monthly security release, Tuesday, June 8, 2021. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
7 CVEs · 0 critical · 7 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
7 CVEs · 0 critical · 7 exploited · 4 with public exploit code
- 8.4HighJun 8, 2021Microsoft Windows Privilege escalationCVE-2021-33739Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.Exploited6.6% likelyExploit code
- 7.8HighJun 8, 2021Microsoft Windows Auth bypass / access controlCVE-2021-1675Windows Print Spooler service Remote code execution of arbitrary code Patch Windows Print Spooler service with the latest updates.Exploited85% likelyExploit codeMetasploitDetection
- 7.8HighJun 8, 2021Microsoft Windows Memory corruptionCVE-2021-31956Windows NTFS file system, unrestricted local system access, update to latest Windows version.Exploited22% likelyExploit code
- 5.5MediumJun 8, 2021Microsoft Windows Information disclosureCVE-2021-31955Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.Exploited81% likelyExploit code
- 7.5HighJun 8, 2021Microsoft Windows Memory corruptionCVE-2021-33742Windows MSHTML platform, Remote code execution, Patch Windows with latest updates.Exploited59% likelyDetection
- 5.2MediumJun 8, 2021Microsoft Enhanced Cryptographic Provider Privilege escalationCVE-2021-31199Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.Exploited3% likely
- 5.2MediumJun 8, 2021Microsoft Enhanced Cryptographic Provider Privilege escalationCVE-2021-31201Microsoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.Exploited2.6% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.