Microsoft · ServicingStack update · December 12, 2023
KB5033383: December 2023 cumulative update for Windows Server 23H2
KB5033383, released December 12, 2023, fixes 19 CVEs in Windows Server 2022, 23H2 Edition (Server Core installation) (build 25398.584). None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.
Urgent1 publicly disclosedUnsupported product
CVEs closed
19
3 rated Critical
Exploited
0
None reported
Exploitation more likely
7
Vendor assessment
Highest EPSS
0.9282
99th percentile
Priority of the 19 CVEs
Patch now 0
Urgent 8
High 7
Routine 4
Applies to
| Product | Build after install |
|---|---|
| Windows Server 2022, 23H2 Edition (Server Core installation) | 25398.584 |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2023-35628 | Windows MSHTML Platform | Remote Code Execution | 8.1 | 0.9282 | More likely |
| Urgent | CVE-2023-36005 | Windows Telephony Server | Elevation of Privilege | 7.5 | 0.2386 | More likely |
| Urgent | CVE-2023-35641 | Windows Internet Connection Sharing (ICS) | Remote Code Execution | 8.8 | 0.0722 | More likely |
| Urgent | CVE-2023-35631 | Windows Win32K | Elevation of Privilege | 7.8 | 0.0655 | More likely |
| Urgent | CVE-2023-35644 | Windows Kernel-Mode Drivers | Elevation of Privilege | 7.8 | 0.0625 | More likely |
| Urgent | CVE-2023-35630 | Windows Internet Connection Sharing (ICS) | Remote Code Execution | 8.8 | 0.0613 | Exploitation Less Likely |
| Urgent | CVE-2023-36696 | Windows Cloud Files Mini Filter Driver | Elevation of Privilege | 7.8 | 0.0086 | More likely |
| Urgent | CVE-2023-36011 | Windows Win32K | Elevation of Privilege | 7.8 | 0.0071 | More likely |
| High | CVE-2023-35638 | Windows DHCP Server | Denial of Service | 7.5 | 0.0326 | Exploitation Less Likely |
| High | CVE-2023-35643 | Windows DHCP Server | Information Disclosure | 7.5 | 0.0265 | Exploitation Less Likely |
| High | CVE-2023-35639 | Windows ODBC Driver | Remote Code Execution | 8.8 | 0.0237 | Exploitation Less Likely |
| High | CVE-2023-36006 | Microsoft WDAC OLE DB provider for SQL | Remote Code Execution | 8.8 | 0.0189 | Exploitation Less Likely |
| High | CVE-2023-35622 | Microsoft Windows DNS | Spoofing | 7.5 | 0.0156 | Exploitation Less Likely |
| High | CVE-2023-36004 | Windows DPAPI (Data Protection Application Programming Interface) | Spoofing | 7.5 | 0.0137 | Exploitation Less Likely |
| High | CVE-2023-21740 | Windows Media | Remote Code Execution | 7.8 | 0.0109 | Exploitation Less Likely |
| Routine | CVE-2023-20588 | Chipsets | Information Disclosure | 6.0 | 0.1115 | DisclosedExploitation Less Likely |
| Routine | CVE-2023-36003 | XAML Diagnostics | Elevation of Privilege | 6.7 | 0.0285 | Exploitation Less Likely |
| Routine | CVE-2023-36012 | Windows DHCP Server | Information Disclosure | 5.3 | 0.0200 | Exploitation Less Likely |
| Routine | CVE-2023-35642 | Windows Internet Connection Sharing (ICS) | Denial of Service | 6.5 | 0.0128 | Exploitation Less Likely |
Showing 1 to 19 of 19
1