Tripwire Patch Priority Index for November 2024

Tripwire’s November 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft and Google Chromium.

First on the list are patches for Microsoft Edge, Excel, and Word that resolve remote code execution and security feature bypass vulnerabilities.

Next are patches that affect components of the core Windows operating system. These patches resolve over 35 vulnerabilities, including elevation of privilege, information disclosure, denial of service, and remote code execution vulnerabilities. These vulnerabilities affect core Windows, Kernel, Win32k, Graphics Component, Secure Kernel Mode, Telephony Service, SMBv3, VMSwitch, DWM core, USB Video Class System Driver, Kerberos, Virtual Hard Disk (VHDX), and others.

After core Windows are patches for Windows Defender Application Control (WDAC) and Microsoft Defender for Endpoint that resolve security feature bypass and information disclosure (or possibly denial of service via system crash) vulnerabilities.

Up next are patches for Visual Studio, Visual Studio Code, and .NET. These patches resolve remote code execution, elevation of privilege, and denial of service vulnerabilities.

Lastly, administrators should focus on server-side patches for Active Directory Certificate Services, Hyper-V, SQL Server, Exchange Server, and DNS Server. These patches resolve denial of service, remote code execution, and elevation of privilege vulnerabilities. Note that there are over 30 patches for SQL Server.