# Microsoft's 'Patch Tuesday' Includes 129 Security Updates, Mostly to Windows 

**URL:** <https://onehack.st/t/microsofts-patch-tuesday-includes-129-security-updates-mostly-to-windows/108402>\
**Category:** News & Articles\
**Tags:** windows\
**Created:** [September 13, 2020, 3:17pm UTC](https://onehack.st/t/microsofts-patch-tuesday-includes-129-security-updates-mostly-to-windows/108402 "2020-09-13T15:17:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [September 13, 2020, 3:17pm UTC](https://onehack.st/t/microsofts-patch-tuesday-includes-129-security-updates-mostly-to-windows/108402/1 "2020-09-13T15:17:18Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/0/900f0464969e328e1153fe1f7f0ea8496aed80e7.png)

This week _Krebs on Security_ reported that Microsoft “released updates to remedy [nearly 130 security vulnerabilities in its Windows operating system and supported software](https://krebsonsecurity.com/2020/09/microsoft-patch-tuesday-sept-2020-edition/).”

_None of the flaws are known to be currently under active exploitation, but 23 of them could be exploited by malware or malcontents to seize complete control of Windows computers with little or no help from users. The [majority of the most dangerous or “critical” bugs](https://applicationreadiness.com/assurance-security-dashboard-september-2020/) deal with issues in Microsoft’s various Windows operating systems and its web browsers, Internet Explorer and Edge. September marks the seventh month in a row Microsoft has shipped fixes for more than 100 flaws in its products, and the fourth month in a row that it fixed more than 120._

 

Among the chief concerns for enterprises this month is [CVE-2020-16875](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875), which involves a critical flaw in the email software Microsoft Exchange Server 2016 and 2019. An attacker could leverage the Exchange bug to run code of his choosing just by sending a booby-trapped email to a vulnerable Exchange server. “That doesn’t quite make it wormable, but it’s about the worst-case scenario for Exchange servers,” said Dustin Childs, of Trend Micro’s Zero Day Initiative. “We have seen the previously patched Exchange bug [CVE-2020-0688](https://krebsonsecurity.com/2020/03/microsoft-patch-tuesday-march-2020-edition/) used in the wild, and that requires authentication. We’ll likely see this one in the wild soon. This should be your top priority.”

_Also not great for companies to have around is [CVE-2020-1210](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1210), which is a remote code execution flaw in supported versions of Microsoft Sharepoint document management software that bad guys could attack by uploading a file to a vulnerable Sharepoint site. Security firm Tenable notes that this bug is reminiscent of [CVE-2019-0604](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0604), another Sharepoint problem that’s been exploited for cybercriminal gains since April 2019._  
The article points out that Google also shipped a critical update for Chrome this week “that resolves at least five security flaws that are rated high severity.”