Microsoft’s April 2019 Patch Tuesday is out, which means Windows admins are getting ready to pull their hair out while testing the new patches and security updates released by Microsoft. Included in this month’s updates are fixes for two vulnerabilities that have been spotted being actively exploited in the wild.

With the release of the April 2019 security updates, Microsoft has released 2 advisories and updates for 74 vulnerabilities, with 15 being classified as Critical. These updates include fixes for actively exploited vulnerabilities discovered by Kaspersky Lab and the Alibaba Cloud Intelligence Security Team.

For information about the non-security Windows updates, you can read about today’s Windows 10 April 2019 Cumulative Updates.

All users should install these security updates as soon as possible to protect Windows from security risks.

Security updates for two actively exploited vulnerabilities

Today’s updates also includes fixes for two Win32k Elevation of Privilege vulnerabilities that are known to be actively exploited in the wild.

The first Win32K Elevation of Privilege vulnerability was discovered by the Alibaba Cloud Intelligence Security Team and has been assigned the ID CVE-2019-0803. The second was discovered by Kaspersky and has been assigned the ID CVE-2019-0859.

Both vulnerabilities have been assigned a severity level of Important and are caused when the Win32k component fails to properly handle objects in memory.  If exploited, the vulnerabilities would allow attackers to install programs; view, change, or delete data; or create new accounts with full user rights.

It is not known how these vulnerabilities are being exploited, but as one was discovered by Kaspersky, it may be malware related.

The April 2019 Patch Tuesday Security Updates

Below is the full list of vulnerabilities resolved, advisories, and SSUs in the April 2019 Patch Tuesday updates.

The information contained in this website is for general information purposes only. The information is gathered from Bleeping Computer while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.