Microsoft June 2024 Patch Tuesday Security Updates: Addressing Critical and Important Vulnerabilities

Microsoft has released its June 2024 Patch Tuesday security updates, addressing a wide range of vulnerabilities across various platforms and services. This month's update resolves numerous critical and important security issues, enhancing the overall security posture for users and organizations. Below, we provide an overview of the resolved vulnerabilities, their severity, and the systems affected.

Key Highlights

Critical Vulnerabilities

1. Windows Server Service:

   • CVE-2024-30080

     : A critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ) that could allow an attacker to execute arbitrary code on the affected system.

Important Vulnerabilities

1. Azure Services:

   • Azure Data Science Virtual Machines:

     • CVE-2024-37325

       : Elevation of privilege vulnerability.

   • Azure File Sync:

     • CVE-2024-35253

       : Elevation of privilege vulnerability.

   • Azure Monitor:

     • CVE-2024-35254

       : Elevation of privilege vulnerability.

   • Azure SDK:

     • CVE-2024-35255

       : Elevation of privilege vulnerability in Azure Identity Libraries and Microsoft Authentication Library.

   • Azure Storage Library:

     • CVE-2024-35252

       : Denial of service vulnerability in Azure Storage Movement Client Library.

2. Dynamics Business Central:

   • CVE-2024-35248

     : Elevation of privilege vulnerability.

   • CVE-2024-35249

     : Remote code execution vulnerability.

3. Microsoft Edge (Chromium-based):

   • Multiple vulnerabilities in Chromium, such as use after free and heap buffer overflow, affecting components like Presentation API, WebRTC, Keyboard Inputs, Dawn, Streams API, and Media Session.

4. Microsoft Office and Related Services:

   • CVE-2024-30101, CVE-2024-30104, CVE-2024-30102

     : Remote code execution vulnerabilities in Microsoft Office.

   • CVE-2024-30103

     : Remote code execution vulnerability in Microsoft Outlook.

   • CVE-2024-30100

     : Remote code execution vulnerability in Microsoft SharePoint Server.

5. Windows Components:

   • CVE-2024-30077

     : Remote code execution vulnerability in Microsoft WDAC OLE DB provider for SQL.

   • CVE-2024-30097

     : Remote code execution vulnerability in Microsoft Speech Application Programming Interface (SAPI).

   • CVE-2024-30070

     : Denial of service vulnerability in Windows DHCP Server.

   • CVE-2024-30063

     : Remote code execution vulnerability in Windows Distributed File System (DFS).

   • CVE-2024-30072

     : Remote code execution vulnerability in Microsoft Event Trace Log File Parsing.

   • CVE-2024-30085

     : Elevation of privilege vulnerability in Windows Cloud Files Mini Filter Driver.

   • CVE-2024-30076

     : Elevation of privilege vulnerability in Windows Container Manager Service.

   • CVE-2024-30096

     : Information disclosure vulnerability in Windows Cryptographic Services.

   • CVE-2024-30064, CVE-2024-30068, CVE-2024-30084, CVE-2024-35250

     : Elevation of privilege vulnerabilities in Windows Kernel and Kernel-Mode Drivers.

   • CVE-2024-30075, CVE-2024-30074

     : Remote code execution vulnerabilities in Windows Link Layer Topology Discovery Protocol.

   • CVE-2024-30099, CVE-2024-30088

     : Elevation of privilege vulnerabilities in Windows NT OS Kernel.

   • CVE-2024-30069

     : Information disclosure vulnerability in Windows Remote Access Connection Manager.

   • CVE-2024-30095, CVE-2024-30094

     : Remote code execution vulnerabilities in Windows Routing and Remote Access Service (RRAS).

   • CVE-2024-30062

     : Remote code execution vulnerability in Windows Standards-Based Storage Management Service.

   • CVE-2024-30083

     : Denial of service vulnerability in Windows Standards-Based Storage Management Service.

   • CVE-2024-30093

     : Elevation of privilege vulnerability in Windows Storage.

   • CVE-2024-30065

     : Denial of service vulnerability in Windows Themes.

   • CVE-2024-30078

     : Remote code execution vulnerability in Windows Wi-Fi Driver.

   • CVE-2024-30086

     : Elevation of privilege vulnerability in Windows Win32 Kernel Subsystem.

   • CVE-2024-30087, CVE-2024-30091, CVE-2024-30082

     : Elevation of privilege vulnerabilities in Windows Win32K - GRFX.

   • CVE-2024-30067, CVE-2024-30066

     : Elevation of privilege vulnerabilities in Winlogon.

6. Visual Studio:

   • CVE-2024-30052

     : Remote code execution vulnerability.

   • CVE-2024-29060

     : Elevation of privilege vulnerability.

   • CVE-2024-29187

     : Vulnerability in WiX Burn-based bundles, allowing binary hijack when run as SYSTEM.