March Patch Tuesday Updates Bring New Windows 11 Features and Fixes for 74 Vulnerabilities

Microsoft has just released the March 2023 Patch Tuesday updates for Windows 11 and Windows 10. For Windows 11 users, today marks the public rollout of the “Moment 2” feature update that brings a new search box to the taskbar and many other new features. 

On the security front, this month’s Patch Tuesday updates include fixes for 74 vulnerabilities in Windows and other components. Two of them are currently being exploited by attackers, including an Outlook spoofing vulnerability. 

74 vulnerabilities fixed in the March Patch Tuesday updates

Here are the most critical vulnerabilities fixed with this month’s Patch Tuesday updates:

• CVE-2023-23397: This Microsoft Outlook Elevation of Privilege Vulnerability is already being exploited by attackers sending specially crafted emails that are triggered automatically when they’re retrieved and processed by the email server.
• CVE-2023-24880: This Windows SmartScreen Security Feature Bypass Vulnerability has been publicly disclosed and is also being exploited by attackers. It requires a malicious malicious file that would evade Mark of the Web (MOTW) defenses.
• CVE-2023-23392: This HTTP Protocol Stack Remote Code Execution Vulnerability could allow an unauthenticated attacker to send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets.
• CVE-2023-23415: This Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability could allow an attacker to send a low-level protocol error containing a fragmented IP packet inside another ICMP packet in its header to the target machine.
• CVE-2023-23411: This Windows Hyper-V Denial of Service Vulnerability could allow a Hyper-V guest to affect the functionality of the Hyper-V host.

You can find the full list of CVEs included in this month’s Patch Tuesday below:

Quality and experience updates

I’ve previously detailed all the new features included in the “Moment 2” update for Windows 11 version 22H2 last month, but here’s a summary of all the new features in this update:

• There’s a new search box in the taskbar for using Windows Search
• The taskbar is now optimized for 2-in-1 devices with new “Expanded” and “Collapsed” states
• On Windows on ARM devices that support Windows Studio Effects, these options are now accessible from Quick Settings in the taskbar
• The Start Menu now displays recommended files on Azure AD joined devices
• Support for new Braille devices and Voice Access improvements.
• Task Manager now lets users filter processes
• The Quick Assist app is now accessible from the All Apps list in the Start Menu
• The Settings app has a new section with Energy Recommendations.

For IT pros managing Windows Updates via Windows Update or WSUS, a new client policy now allows them to control the availability of new features introduced via servicing. Moreover, Microsoft said that new features that may be disruptive such as the new touch-optimized taskbar are disabled by default on managed devices. 

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.

If you have any problems with this month’s patches, please let us know in the comments below. Other readers might be able to share their experiences in how to roll back problematic updates or mitigate issues caused by patches that are important to have in place.