Microsoft releases emergency security updates for Windows and Visual Studio


Microsoft has published today two out-of-band security updates to address security issues in the Windows Codecs library and the Visual Studio Code application.

The two updates come as late arrivals after the company released its monthly batch of security updates earlier this week, on Tuesday, patching 87 vulnerabilities this month.

Both new vulnerabilities are “remote code execution” flaws, allowing attackers to execute code on impacted systems.

Windows Codecs Library vulnerability

The first bug is tracked as CVE-2020-17022. Microsoft says that attackers can craft malicious images that, when processed by an app running on top of Windows, can allow the attacker to execute code on an unpatched Windows OS.

All Windows 10 versions are impacted.

Microsoft said an update for this library would be automatically installed on user systems via the Microsoft Store.

Not all users are impacted, but only those who have installed the optional HEVC or “HEVC from Device Manufacturer” media codecs from Microsoft Store.

HEVC is not available for offline distribution and is only available via the Microsoft Store. The library is also not supported on Windows Server.

To check and see if you’re using a vulnerable HEVC codec, users can go to Settings, Apps & Features, and select HEVC, Advanced Options. The secure versions are 1.0.32762.0, 1.0.32763.0, and later.

Visual Studio Code vulnerability

The second bug is tracked as CVE-2020-17023. Microsoft says attackers can craft malicious package.json files that, when loaded in Visual Studio Code, can execute malicious code.

Depending on the user’s permissions, an attacker’s code could execute with administrator privileges and allow them full control over an infected host.

Package.json files are regularly used with JavaScript libraries and projects. JavaScript, and especially its server-side Node.js technology, are one of today’s most popular technologies.

Visual Studio Code users are advised to update the app as soon as possible to the latest version.

Source link

Recent articles

Should You FedEx Your Mail-In Ballot?

With Election Day a week away, those who have waited until nearly the last minute to vote by mail may be considering turning...

Meet Apex Legends’ Next Character In New Reveal Trailer

Apex Legends is still going strong. A new "Stories From The Outlands" trailer places the spotlight on the next legend: Dr. Mary Somers or, as...

Spooky Fall Event is now live

I always knew that Minecraft Dungeons was secretly a survival horror game (the Arch-Illager's laugh has given me nightmares for months). Well, now...

Colleges Are Slashing Budgets – The New York Times

This is the Coronavirus Schools Briefing, a guide to the seismic changes in U.S. education that are taking place during the pandemic. Sign...

Leave a reply

Please enter your comment!
Please enter your name here