Microsoft Patch Tuesday- December 2021

Issued: Thursday, 16 December, 2021	Last Revision: Thursday, 16 December, 2021
Vendor: Microsoft	Product: Multiple products
	Severity Level: High

Summary:

Microsoft has released patches for 67 vulnerabilities with seven classified as critical, sixty classified as important including a Zero-day being actively exploited in the wild. Zero-day vulnerability (CVE-202143890) was exploited in the wild to spread Emotet, Trickbot, and other malware through fake applications.

In December 2021 Microsoft has fixed problems of Privilege escalation, Remote Code Execution, Denial of Service, and Spoofing Vulnerabilities.

Products patched in December security update includes ASP.NET Core and Visual Studio, Azure Bot Framework SDK, Internet Storage Name Service, Defender for IoT, Microsoft Office and Office Components, SharePoint Server, Remote Desktop Client, Windows Hyper-V, Windows Mobile Device Management, Windows Remote Access Connection Manager, TCP/IP, Windows Update Stack, Microsoft PowerShell, The Chromium-based Edge browser, The Windows Kernel, Print Spooler, and Remote Desktop Client.

Organizations are strongly encouraged to apply patches as soon as possible, particularly patches for exploited zero day, and critical vulnerabilities.

CVE/Vulnerability	Description	CVSS3.0 Score
CVE-2021-41333	Windows Print Spooler Elevation of Privilege Vulnerability	7.8
CVE-2021-43207	Windows Common Log File System Driver Elevation of Privilege Vulnerability	7.8
CVE-2021-43215	iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution	9.8
CVE-2021-43226	Windows Common Log File System Driver Elevation of Privilege Vulnerability	7.8
CVE-2021-43233	Remote Desktop Client Remote Code Execution Vulnerability	7.5
CVE-2021-43240	NTFS Set Short Name Elevation of Privilege Vulnerability	7.8
CVE-2021-43880	Windows Mobile Device Management Elevation of Privilege Vulnerability	5.5
CVE-2021-43883	Windows Installer Elevation of Privilege Vulnerability	7.8
CVE-2021-43890	Windows AppX Installer Spoofing Vulnerability	7.1
CVE-2021-43893	Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability	7.5
CVE-2021-43905	Microsoft Office app Remote Code Execution Vulnerability	9.6

Table 1: Vulnerability details

CVE/Vulnerability

Affected Product(s)

CVE-2021-41333

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 (Server Core installation)

Windows Server 2012

Windows Server 2008 R2 for x64based Systems Service Pack 1 (Server Core installation)

Windows Server 2008 R2 for x64based Systems Service Pack 1

Windows Server 2008 for x64based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for x64based Systems Service Pack 2

Windows Server 2008 for 32bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for 32bit Systems Service Pack 2

Windows RT 8.1

Windows 8.1 for x64based systems

Windows 8.1 for 32bit systems

Windows 7 for x64based Systems Service Pack 1

Windows 7 for 32bit Systems Service Pack 1

Windows Server 2016 (Server Core installation)

Windows Server 2016

Windows 10 Version 1607 for x64based Systems

Windows 10 Version 1607 for 32bit Systems

Windows 10 for x64based Systems

Windows 10 for 32bit Systems

Windows 10 Version 21H2 for x64based Systems

Windows 10 Version 21H2 for ARM64based Systems

Windows 10 Version 21H2 for 32bit Systems

Windows 11 for ARM64based Systems

Windows 11 for x64based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64based Systems

Windows 10 Version 20H2 for 32bit Systems

Windows 10 Version 20H2 for x64based Systems

Windows Server, version 2004 (Server Core installation)

Windows 10 Version 2004 for x64based Systems

Windows 10 Version 2004 for ARM64based Systems

Windows 10 Version 2004 for 32bit Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32bit Systems

Windows 10 Version 21H1 for ARM64based Systems

Windows 10 Version 21H1 for x64based Systems

Windows 10 Version 1909 for ARM64based Systems

Windows 10 Version 1909 for x64based Systems

Windows 10 Version 1909 for 32bit Systems

Windows Server 2019 (Server Core installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64based Systems

Windows 10 Version 1809 for x64based Systems

Windows 10 Version 1809 for 32bit Systems

CVE-2021-43207