Tripwire Patch Priority Index for December 2023

Tripwire’s December 2023 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google.

First on the patch priority are patches for Google Chrome and Microsoft Edge (Chromium-based) that resolve elevation of privilege, remote code execution, and information disclosure vulnerabilities. Please note that CVE-2023-7024 for Chrome is on the CISA Known Exploited Vulnerabilities (KEV) catalog, which means this vulnerability has been actively exploited.

Next on the patch priority list this month are patches for Microsoft Word and Outlook that resolve 2 information disclosure and 1 spoofing vulnerabilities.

Next are patches that affect components of the core Windows operating system. These patches resolve over 20 vulnerabilities, including elevation of privilege, information disclosure, and remote code execution vulnerabilities. These vulnerabilities affect core Windows, Kernel, Media, Bluetooth Driver, ICS, MSHTML, Sysmain, and others.

Lastly, administrators should focus on server-side patches for DNS, DHCP, and Dynamics. These patches several numerous issues including spoofing, cross site scripting, denial of service, and information disclosure vulnerabilities.