Microsoft November 2021 Patch Tuesday fixes 6 zero-days, 55 flaws

Today is Microsoft's November 2021 Patch Tuesday, and with it comes fixes for six zero-day vulnerabilities and a total of 55 flaws. The actively exploited vulnerabilities are for Microsoft Exchange and Excel, with the Exchange zero-day used as part of the Tianfu hacking contest.

Microsoft has fixed 55 vulnerabilities with today's update, with six classified as Critical and 49 as Important. The number of each type of vulnerability is listed below:

• 20 Elevation of Privilege vulnerabilities
• 2 Security Feature Bypass vulnerabilities
• 15 Remote Code Execution vulnerabilities
• 10 Information Disclosure vulnerabilities
• 3 Denial of Service vulnerabilities
• 4 Spoofing vulnerabilities

For information about the non-security Windows updates, you can read about today's Windows 10 KB5007186 & KB5007189 cumulative updates and the Windows 11 KB5007215 cumulative update.

Six zero-days fixed, with two actively exploited

November's Patch Tuesday includes fixes for six zero-day vulnerabilities, two actively exploited against Microsoft Exchange and Microsoft Excel.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The actively exploited vulnerabilities fixed this month are:

• CVE-2021-42292 - Microsoft Excel Security Feature Bypass Vulnerability
• CVE-2021-42321 - Microsoft Exchange Server Remote Code Execution Vulnerability

The Microsoft Exchange CVE-2021-42321 vulnerability is an authenticated remote code execution bug used as part of the Tianfu Cup hacking contest last month.

However, the Microsoft Excel CVE-2021-42292 was discovered by the Microsoft Threat Intelligence Center and has been actively used in malicious attacks.

The security updates for Microsoft Office for Mac have not been released as of yet.

Microsoft also fixed four other publicly disclosed vulnerabilities that are not known to be exploited in attacks.

• CVE-2021-38631 - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
• CVE-2021-41371 - Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
• CVE-2021-43208 - 3D Viewer Remote Code Execution Vulnerability
• CVE-2021-43209 - 3D Viewer Remote Code Execution Vulnerability

Recent updates from other companies

Other vendors who released updates in November include:

• Adobe's November security updates were released for various applications.
• Android's November security updates were released last week.
• Cisco released security updates for numerous products this month, including a hard-coded password and SSH key vulnerability.
• SAP released its November 2021 security updates.

The November 2021 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities and released advisories in the November 2021 Patch Tuesday updates. To access the full description of each vulnerability and the systems that it affects, you can view the full report here.

Microsoft November 2021 Patch Tuesday fixes 6 zero-days, 55 flaws