Microsoft's security release of 12 December 2023
Patch Tuesday, December 2023
As of , CISA lists none of the 33 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2023-35628, Windows MSHTML Platform Remote Code Execution.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 33 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 10 CVEs |
| Not assessed by CISA's SSVC | 23 CVEs |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 4 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-35628Windows MSHTML Platform Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.93 |
| 2 | CVE-2023-36005Windows Telephony Server Elevation of Privilege | Not assessed | Not on CISA's list | 7.5 High | 0.24 |
| 3 | CVE-2023-35636Microsoft Outlook Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.18 |
| 4 | CVE-2023-36019Microsoft Power Platform Connector Spoofing | Not assessed | Not on CISA's list | 9.6 Critical | 0.16 |
| 5 | CVE-2023-35633Windows Kernel Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.09 |
| 6 | CVE-2023-35641Internet Connection Sharing (ICS) Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.07 |
| 7 | CVE-2023-35631Win32k Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.07 |
| 8 | CVE-2023-35632Windows Ancillary Function Driver for WinSock Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.07 |
| 9 | CVE-2023-36391Local Security Authority Subsystem Service Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.07 |
| 10 | CVE-2023-35630Internet Connection Sharing (ICS) Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.06 |
| 11 | CVE-2023-35644Windows Sysmain Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.06 |
| 12 | CVE-2023-35638DHCP Server Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 13 | CVE-2023-35643DHCP Server Service Information Disclosure | Not assessed | Not on CISA's list | 7.5 High | 0.03 |
| 14 | CVE-2023-36010Microsoft Defender Denial of Service | Not assessed | Not on CISA's list | 7.5 High | 0.03 |
| 15 | CVE-2023-36003XAML Diagnostics Elevation of Privilege | Not assessed | Not on CISA's list | 6.7 Medium | 0.03 |
| 16 | CVE-2023-35639Microsoft ODBC Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 17 | CVE-2023-36006Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | Not assessed | Not on CISA's list | 8.8 High | 0.02 |
| 18 | CVE-2023-35621Microsoft Dynamics 365 Finance and Operations Denial of Service | Not assessed | Not on CISA's list | 7.5 High | 0.02 |
| 19 | CVE-2023-35622Windows DNS Spoofing | None | Not on CISA's list | 7.5 High | 0.02 |
| 20 | CVE-2023-36012DHCP Server Service Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.02 |
| 21 | CVE-2023-35634Windows Bluetooth Driver Remote Code Execution | Not assessed | Not on CISA's list | 8.0 High | 0.01 |
| 22 | CVE-2023-21740Windows Media Remote Code Execution | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2023-36011Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2023-36696Windows Cloud Files Mini Filter Driver Elevation of Privilege | Not assessed | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2023-36020Microsoft Dynamics 365 (on-premises) Cross-site Scripting | Not assessed | Not on CISA's list | 7.6 High | 0.01 |
| 26 | CVE-2023-36004Windows DPAPI (Data Protection Application Programming Interface) Spoofing | Not assessed | Not on CISA's list | 7.5 High | 0.01 |
| 27 | CVE-2023-35624Azure Connected Machine Agent Elevation of Privilege | Not assessed | Not on CISA's list | 7.3 High | 0.01 |
| 28 | CVE-2023-35629Microsoft USBHUB 3.0 Device Driver Remote Code Execution | Not assessed | Not on CISA's list | 6.8 Medium | 0.01 |
| 29 | CVE-2023-35642Internet Connection Sharing (ICS) Denial of Service | Not assessed | Not on CISA's list | 6.5 Medium | 0.01 |
| 30 | CVE-2023-35635Windows Kernel Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 31 | CVE-2023-36009Microsoft Word Information Disclosure | Not assessed | Not on CISA's list | 5.5 Medium | 0.01 |
| 32 | CVE-2023-35619Microsoft Outlook for Mac Spoofing | Not assessed | Not on CISA's list | 5.3 Medium | 0.01 |
| 33 | CVE-2023-35625Azure Machine Learning Compute Instance for SDK Users Information Disclosure | None | Not on CISA's list | 4.7 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 12 December 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.