Microsoft · Security update · July 13, 2021

KB5004298: July 2021 security update

KB5004298, released July 13, 2021, fixes 49 CVEs across 5 products. 3 of them are being exploited (CVE-2021-34448); 3 on CISA KEV. Patch Radar priority: Patch now.

Patch now3 on CISA KEV1 publicly disclosed
CVEs closed
49
3 rated Critical
Exploited
3
CVE-2021-34448
Exploitation more likely
1
Microsoft's assessment
Highest EPSS
0.4006
98th percentile

Priority of the 49 CVEs

Patch now 3 Urgent 3 High 27 Routine 16

Applies to

Product
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2021-34448 Microsoft Scripting EngineRemote Code Execution6.8 0.4006 KEVExploited
Patch now CVE-2021-33771 Windows KernelElevation of Privilege7.8 0.1017 KEVExploited
Patch now CVE-2021-31979 Windows KernelElevation of Privilege7.8 0.0454 KEVExploited
Urgent CVE-2021-34494 Role: DNS ServerRemote Code Execution8.8 0.0405 Exploitation Less Likely
Urgent CVE-2021-33780 Role: DNS ServerRemote Code Execution8.8 0.0271 More likely
Urgent CVE-2021-34497 Windows MSHTML PlatformRemote Code Execution6.8 0.0215 Exploitation Less Likely
High CVE-2020-17049 Microsoft WindowsSecurity Feature Bypass7.2 0.1379 Exploitation Less Likely
High CVE-2021-31183 Windows TCP/IPDenial of Service7.5 0.0384 Exploitation Less Likely
High CVE-2021-34504 Windows Address BookRemote Code Execution7.8 0.0347 Exploitation Less Likely
High CVE-2021-33788 Windows Local Security Authority Subsystem Service (LSASS)Denial of Service7.5 0.0328 Exploitation Less Likely
High CVE-2021-34476 Common Internet File SystemDenial of Service7.5 0.0328 Exploitation Less Likely
High CVE-2021-34442 Role: DNS ServerRemote Code Execution8.8 0.0317 Exploitation Less Likely
High CVE-2021-34492 Windows PFX EncryptionSpoofing8.1 0.0247 DisclosedExploitation Less Likely
High CVE-2021-33749 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33750 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33752 Role: DNS ServerRemote Code Execution8.8 0.0242 Exploitation Less Likely
High CVE-2021-33756 Role: DNS ServerRemote Code Execution8.8 0.0241 Exploitation Less Likely
High CVE-2021-34525 Role: DNS ServerRemote Code Execution8.8 0.0225 Exploitation Less Likely
High CVE-2021-34441 Microsoft Windows Media FoundationRemote Code Execution7.8 0.0222 Exploitation Less Likely
High CVE-2021-33786 Windows Local Security Authority Subsystem Service (LSASS)Security Feature Bypass8.1 0.0212 Exploitation Less Likely
High CVE-2021-34446 Windows HTML PlatformSecurity Feature Bypass8.0 0.0205 Exploitation Less Likely
High CVE-2021-33746 Microsoft Windows DNSRemote Code Execution8.0 0.0200 Exploitation Less Likely
High CVE-2021-33754 Microsoft Windows DNSRemote Code Execution8.0 0.0198 Exploitation Less Likely
High CVE-2021-34516 Windows Win32KElevation of Privilege7.8 0.0130 Exploitation Less Likely
High CVE-2021-34498 Microsoft Graphics ComponentElevation of Privilege7.8 0.0106 Exploitation Less Likely
Showing 1 to 25 of 49 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.