Microsoft · Security update · October 11, 2022

KB5018474: October 2022 security update

KB5018474, released October 11, 2022, fixes 49 CVEs across 5 products. 2 of them are being exploited (CVE-2022-38028); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
49
8 rated Critical
Exploited
2
CVE-2022-38028
Exploitation more likely
4
Microsoft's assessment
Highest EPSS
0.5627
99th percentile

Priority of the 49 CVEs

Patch now 2 Urgent 12 High 24 Routine 11

Applies to

Product
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2022-38028 Windows Print Spooler ComponentsElevation of Privilege7.8 0.1495 KEVExploited
Patch now CVE-2022-41033 Windows COM+ Event System ServiceElevation of Privilege7.8 0.0189 KEVExploited
Urgent CVE-2022-37989 Client Server Run-time Subsystem (CSRSS)Elevation of Privilege7.8 0.0933 More likely
Urgent CVE-2022-37987 Client Server Run-time Subsystem (CSRSS)Elevation of Privilege7.8 0.0910 More likely
Urgent CVE-2022-38051 Microsoft Graphics ComponentElevation of Privilege7.8 0.0732 More likely
Urgent CVE-2022-37976 Role: Active Directory Certificate Services; Active Directory Domain ServicesElevation of Privilege8.8 0.0239 Exploitation Less Likely
Urgent CVE-2022-41081 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0195 Exploitation Less Likely
Urgent CVE-2022-38000 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0163 Exploitation Less Likely
Urgent CVE-2022-22035 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0157 Exploitation Less Likely
Urgent CVE-2022-33634 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0147 Exploitation Less Likely
Urgent CVE-2022-38047 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0147 Exploitation Less Likely
Urgent CVE-2022-24504 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0146 Exploitation Less Likely
Urgent CVE-2022-30198 Windows Point-to-Point Tunneling ProtocolRemote Code Execution8.1 0.0146 Exploitation Less Likely
Urgent CVE-2022-37997 Microsoft Graphics ComponentElevation of Privilege7.8 0.0068 More likely
High CVE-2022-38044 Windows CD-ROM DriverRemote Code Execution7.8 0.5627 Exploitation Less Likely
High CVE-2022-38034 Windows Workstation ServiceElevation of Privilege8.8 0.0400 Exploitation Less Likely
High CVE-2022-38045 Windows Server ServiceElevation of Privilege8.8 0.0281 Exploitation Less Likely
High CVE-2022-33645 Windows TCP/IPDenial of Service7.5 0.0267 Exploitation Less Likely
High CVE-2022-38041 Windows Secure ChannelDenial of Service7.5 0.0261 Exploitation Less Likely
High CVE-2022-37982 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0202 Exploitation Less Likely
High CVE-2022-38031 Microsoft WDAC OLE DB provider for SQLRemote Code Execution8.8 0.0202 Exploitation Less Likely
High CVE-2022-38040 Windows ODBC DriverRemote Code Execution8.8 0.0202 Exploitation Less Likely
High CVE-2022-37975 Windows Group PolicyElevation of Privilege8.8 0.0193 Exploitation Less Likely
High CVE-2022-37978 Windows Active Directory Certificate ServicesSecurity Feature Bypass7.5 0.0185 Exploitation Less Likely
High CVE-2022-38042 Active Directory Domain ServicesElevation of Privilege7.1 0.0182 Exploitation Less Likely
Showing 1 to 25 of 49 1Next

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.