--- title: "Security digest: August 13, 2024" url: https://erroneo.us/security/2024-08-13/ description: "August 13, 2024 vulnerability digest: 1 brief (Windows TCP/IP IPv6 Remote Code Execution…); 6 CISA KEV additions (Microsoft); 1 critical advisory…" type: security-digest-day section: "Security Digest" date_published: 2024-08-13 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: August 13, 2024 1 editorial brief, 6 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Patch this week: Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063) . Admins of Windows or Windows Server machines with IPv6 enabled that have missed cumulative updates since August 2024, starting with hosts reachable over IPv6 from untrusted networks. - Do you run any of these? Microsoft Windows, Microsoft Project. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-09-03. - RubyGems: 1 critical advisory ( sequenceserver ). Check with bundle audit check --update . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Patch this week** [Windows TCP/IP IPv6 Remote Code Execution (CVE-2024-38063)](https://erroneo.us/security/briefs/windows-tcpip-ipv6-rce-cve-2024-38063/index.md): Serious on paper and worth patching promptly, but there is no known in-the-wild exploitation, public code is a flaky crash-oriented proof of concept, and any machine on August 2024 or later cumulative updates is already fixed. ## Known exploited (CISA KEV) - [CVE-2024-38213](https://erroneo.us/security/cve/CVE-2024-38213/index.md) Microsoft Windows: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability (CISA due 2024-09-03) - [CVE-2024-38193](https://erroneo.us/security/cve/CVE-2024-38193/index.md) Microsoft Windows: Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability (CISA due 2024-09-03) - [CVE-2024-38189](https://erroneo.us/security/cve/CVE-2024-38189/index.md) Microsoft Project: Microsoft Project Remote Code Execution Vulnerability (CISA due 2024-09-03) - [CVE-2024-38178](https://erroneo.us/security/cve/CVE-2024-38178/index.md) Microsoft Windows: Microsoft Windows Scripting Engine Memory Corruption Vulnerability (CISA due 2024-09-03) - [CVE-2024-38107](https://erroneo.us/security/cve/CVE-2024-38107/index.md) Microsoft Windows: Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability (CISA due 2024-09-03) - [CVE-2024-38106](https://erroneo.us/security/cve/CVE-2024-38106/index.md) Microsoft Windows: Microsoft Windows Kernel Privilege Escalation Vulnerability (CISA due 2024-09-03) ## Critical advisories - [CVE-2024-42360](https://erroneo.us/security/cve/CVE-2024-42360/index.md) Command Injection in sequenceserver — RubyGems sequenceserver < 3.1.2 → 3.1.2 --- Source page: https://erroneo.us/security/2024-08-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt