CNNVD关于微软多个安全漏洞的通报
近日，微软官方发布了多个安全漏洞的公告，共61个漏洞。包括多款Microsoft产品资源管理错误漏洞（CNNVD-202205-2800、CVE-2022-23267）、Microsoft Visual Studio 安全漏洞（CNNVD-202204-3059、CVE-2022-24513）等多个漏洞。成功利用上述漏洞的攻击者可以在目标系统上执行任意代码、获取用户数据，提升权限等。微软多个产品和系统受漏洞影响。目前，微软官方已经发布了漏洞修复补丁，建议用户及时确认是否受到漏洞影响，尽快采取修补措施。
一、 漏洞介绍
2022年6月14日，微软发布了2022年6月份安全更新，共61个漏洞的补丁程序，CNNVD对这些漏洞进行了收录。本次更新主要涵盖了Microsoft Windows 和 Windows 组件、Microsoft Azure Real Time
Operating System、Microsoft Windows Defender、Microsoft Windows ALPC、Microsoft Windows
File History Service、Microsoft Windows Local Security
Authority Subsystem Service等。CNNVD对其危害等级进行了评价，其中高危漏洞29个，中危漏洞32个。微软多个产品和系统版本受漏洞影响，具体影响范围可访问
https://portal.msrc.microsoft.com/zh-cn/security-guidance查询。
二、漏洞详情
此次更新共包括55个新增漏洞的补丁程序，其中高危漏洞29个，中危漏洞26个。
序号 | 漏洞名称 | CNNVD编号 | CVE编号 | 危害等级 | 官方链接 |
1 | 多款Microsoft产品资源管理错误漏洞 | CNNVD-202205-2800 | CVE-2022-23267 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23267 |
2 | Microsoft Visual Studio 安全漏洞 | CNNVD-202204-3059 | CVE-2022-24513 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24513 |
3 | Microsoft Windows 权限许可和访问控制问题漏洞 | CNNVD-202204-3114 | CVE-2022-24527 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24527 |
4 | Microsoft .NET Framework输入验证错误漏洞 | CNNVD-202204-3008 | CVE-2022-26832 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26832 |
5 | Microsoft SQL Server 安全漏洞 | CNNVD-202206-1391 | CVE-2022-29143 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143 |
6 | Microsoft Azure 安全漏洞 | CNNVD-202206-1214 | CVE-2022-29149 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149 |
7 | Microsoft Windows 安全漏洞 | CNNVD-202206-1286 | CVE-2022-30140 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30140 |
8 | Microsoft Windows File History Service 安全漏洞 | CNNVD-202206-1283 | CVE-2022-30142 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30142 |
9 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1278 | CVE-2022-30143 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30143 |
10 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1264 | CVE-2022-30146 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30146 |
11 | Microsoft Windows Installer 安全漏洞 | CNNVD-202206-1257 | CVE-2022-30147 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30147 |
12 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1239 | CVE-2022-30149 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30149 |
13 | Microsoft Windows Defender 安全漏洞 | CNNVD-202206-1237 | CVE-2022-30150 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30150 |
14 | Microsoft Windows Ancillary Function Driver for WinSock 安全漏洞 | CNNVD-202206-1234 | CVE-2022-30151 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30151 |
15 | Microsoft Windows 安全漏洞 | CNNVD-202206-1230 | CVE-2022-30152 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30152 |
16 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1228 | CVE-2022-30153 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30153 |
17 | Microsoft SharePoint 安全漏洞 | CNNVD-202206-1371 | CVE-2022-30158 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30158 |
18 | Microsoft Windows ALPC 安全漏洞 | CNNVD-202206-1226 | CVE-2022-30160 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30160 |
19 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1225 | CVE-2022-30161 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30161 |
20 | Microsoft Hyper-V 安全漏洞 | CNNVD-202206-1223 | CVE-2022-30163 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30163 |
21 | Microsoft Windows Kerberos 安全漏洞 | CNNVD-202206-1222 | CVE-2022-30164 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30164 |
22 | Microsoft Windows Kerberos 安全漏洞 | CNNVD-202206-1219 | CVE-2022-30165 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30165 |
23 | Microsoft Windows Local Security Authority Subsystem Service 安全漏洞 | CNNVD-202206-1221 | CVE-2022-30166 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30166 |
24 | Microsoft Excel 安全漏洞 | CNNVD-202206-1311 | CVE-2022-30173 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30173 |
25 | Microsoft Office 安全漏洞 | CNNVD-202206-1399 | CVE-2022-30174 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30174 |
26 | Microsoft Azure Real Time Operating System 安全漏洞 | CNNVD-202206-1424 | CVE-2022-30178 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30178 |
27 | 多款Microsoft产品安全漏洞 | CNNVD-202206-1432 | CVE-2022-30188 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30188 |
28 | Microsoft Windows Support Diagnostic Tool 操作系统命令注入漏洞 | CNNVD-202205-4277 | CVE-2022-30190 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190 |
29 | Microsoft Windows SMBv3 代码问题漏洞 | CNNVD-202206-1215 | CVE-2022-32230 | 高危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-32230 |
30 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202206-1229 | CVE-2022-30155 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30155 |
31 | Microsoft Office 安全漏洞 | CNNVD-202206-1350 | CVE-2022-30159 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30159 |
32 | Microsoft Windows Kernel 安全漏洞 | CNNVD-202206-1224 | CVE-2022-30162 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30162 |
33 | Microsoft Office 安全漏洞 | CNNVD-202206-1329 | CVE-2022-30171 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30171 |
34 | Microsoft Office安全漏洞 | CNNVD-202206-1316 | CVE-2022-30172 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30172 |
35 | Microsoft .NET Core和Microsoft Visual Studio 安全漏洞 | CNNVD-202206-1317 | CVE-2022-30184 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30184 |
36 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202206-1341 | CVE-2022-29111 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29111 |
37 | 多款Microsoft产品安全漏洞 | CNNVD-202206-1438 | CVE-2022-29119 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29119 |
38 | Microsoft Windows Container Isolation FS Filter Driver 安全漏洞 | CNNVD-202206-1300 | CVE-2022-30131 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30131 |
39 | Microsoft Windows Container Manager Service 安全漏洞 | CNNVD-202206-1291 | CVE-2022-30132 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30132 |
40 | Microsoft Windows Media Foundation 安全漏洞 | CNNVD-202206-1290 | CVE-2022-30135 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30135 |
41 | Microsoft Windows Network File System 安全漏洞 | CNNVD-202206-1289 | CVE-2022-30136 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30136 |
42 | Microsoft Azure 安全漏洞 | CNNVD-202206-1362 | CVE-2022-30137 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30137 |
43 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1288 | CVE-2022-30139 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30139 |
44 | Microsoft Lightweight Directory Access Protocol 安全漏洞 | CNNVD-202206-1285 | CVE-2022-30141 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30141 |
45 | Microsoft Windows Encrypting File System 安全漏洞 | CNNVD-202206-1270 | CVE-2022-30145 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30145 |
46 | Microsoft Windows PowerShell 安全漏洞 | CNNVD-202206-1246 | CVE-2022-30148 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30148 |
47 | Microsoft Remote Volume Shadow Copy Service 安全漏洞 | CNNVD-202206-1227 | CVE-2022-30154 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30154 |
48 | Microsoft SharePoint 安全漏洞 | CNNVD-202206-1387 | CVE-2022-30157 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30157 |
49 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202206-1411 | CVE-2022-30167 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30167 |
50 | Microsoft Windows App Store 安全漏洞 | CNNVD-202206-1454 | CVE-2022-30168 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30168 |
51 | Microsoft Azure Real Time Operating System 安全漏洞 | CNNVD-202206-1421 | CVE-2022-30177 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30177 |
52 | Microsoft Azure Real Time Operating System 安全漏洞 | CNNVD-202206-1428 | CVE-2022-30179 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30179 |
53 | Microsoft Azure Real Time Operating System 安全漏洞 | CNNVD-202206-1431 | CVE-2022-30180 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30180 |
54 | Microsoft Windows 安全漏洞 | CNNVD-202206-1220 | CVE-2022-30189 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30189 |
55 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202206-1465 | CVE-2022-30193 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30193 |
此次更新共包括6个更新漏洞的补丁程序，其中中危漏洞6个。
序号 | 漏洞名称 | CNNVD编号 | CVE编号 | 危害等级 | 官方链接 |
1 | MicrosoftWindows DCOM Server 安全特征问题漏洞 | CNNVD-202106-546 | CVE-2021-26414 | 中危 | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26414 |
2 | Microsoft Windows Codecs Library 安全漏洞 | CNNVD-202206-1347 | CVE-2022-22018 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018 |
3 | Microsoft Windows 安全漏洞 | CNNVD-202206-1330 | CVE-2022-21166 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21166 |
4 | Microsoft Windows 安全漏洞 | CNNVD-202206-1336 | CVE-2022-21123 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21123 |
5 | Microsoft Windows 安全漏洞 | CNNVD-202206-1339 | CVE-2022-21125 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21125 |
6 | Microsoft Windows 安全漏洞 | CNNVD-202206-1332 | CVE-2022-21127 | 中危 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21127 |
三、修复建议
目前，微软官方已经发布补丁修复了上述漏洞，建议用户及时确认漏洞影响，尽快采取修补措施。微软官方补丁下载地址：
https://msrc.microsoft.com/update-guide/en-us
CNNVD将继续跟踪上述漏洞的相关情况，及时发布相关信息。如有需要，可与 CNNVD联系。联系方式:
cnnvdvul@itsec.gov.cn