KB5033373 for Windows 10 version 1607

by
This content has been archived. But, the content is true and relevant to the underlying technology products or infrastructure services.
LinkedIn

KB5033373 is the monthly cumulative update for Windows 10 version 1607. This update was released on 12 December 2023 under the ‘Patch Tuesday’ project.

KB5033373 has also been released for Windows Server 2016 and Windows Server 2016 Server Core installation. You can find more information about KB5033373 for Windows Server 2016 on the relevant page.

Salient points

  • KB5033373 is for Windows 10 version 1607 for December 2023. The update is available for x86 and x64 platforms. This update supersedes KB5032197.
  • KB5033373 corresponds to Windows 10 build 14393.6529.
  • KB5032197 for Windows 10 version 1607 corresponds to Windows 10 build 14393.6452.
  • KB5032391 is the Servicing Stack Update corresponding to KB5032197 and KB5033373 for Windows 10 version 1607. The SSU is available separately for x86 and x64 platforms.
  • KB5032391 was released in November 2023. There has been no new release for the Servicing Stack Update in December 2023.
  • 13 security vulnerabilities affect Windows 10 version 1607 for x64 and x86 architectures.
  • 3 security vulnerabilities have a ‘CRITICAL’ severity level. All these could cause the ‘Remote Code Execution’ attacks.
  • There is a single zero-day vulnerability CVE-2023-20588 that affects Windows 10 version 1607.

Download KB5033373 for Windows 10 version 1607

KB5033373 for Windows 10 version 1607 can be deployed through one of the following automated processes:

  • Windows Update
  • Windows Update for Business
  • WSUS or Windows Server Update Services

WSUS is the most preferred method to patch Windows 10 workstations with the latest cumulative updates.

For automated deployments, the Servicing Stack Update is installed automatically prior to the installation of the KB5033373 cumulative update. There is no system reboot after deploying the Servicing Stack Update.

KB5033373 can be applied on Windows 10 version 1607 in a manual approach. For this, you will need to follow a two-step process.

  1. Download and install the Servicing Stack Update KB5032391 on Windows 10 version 1607.
  2. Download and install KB5033373 cumulative update for Windows 10 version 1607.

We have shared both steps below.

You could download the offline installer files for the Servicing Stack Update and the cumulative update from the Microsoft Update Catalog site. Or, you could use the download links shared below to download the .MSU file directly.

Once you have installed the Servicing Stack Update, you can proceed with the installation of KB5033373 on Windows 10 version 1607. The download links for KB5033373 are specified below.

When you deploy KB5033373 on Windows 10 version 1607, your system will reboot or restart.

All changes of KB5032197 are included in KB5033373. If you did not install KB5032197, you can skip and install KB5033373. The SSU KB5032391 will be automatically installed as part of the KB5033373 cumulative update.

Vulnerabilities

13 security vulnerabilities affect Windows 10 version 1607 for x64 systems. There are 13 vulnerabilities on the x86 and x64 editions of Windows 10 version 1607. We look at the 3 CRITICAL threats below. There is also a zero-day threat affecting the AMD servers.

Zero-day vulnerabilities

The following zero-day threat was first reported in August 2023. It has been mitigated in the current Windows Update cycle. Therefore, we suggest immediate deployment of the cumulative update KB5033373 for Windows Server 10 x86 and x64 versions.

CVE detailsCVSSSeverityImpact Description
CVE-2023-205885.5IMPORTANTInformation DisclosureA division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.

CRITICAL vulnerabilities

There are 3 CRITICAL vulnerabilities affecting Windows 10 version 1607 x64 and x86 system architecture. All these are the ‘Remote Code Execution’ while the other one is an ‘Elevation of Privilege’ threat. These vulnerabilities are shared below for your ready reference.

CVE detailsCVSSSeverityImpact Description
CVE-2023-356308.8CRITICALRemote Code ExecutionThis threat impacts the Internet Connection Sharing (ICS).

Successful exploitation of this vulnerability requires the attacker to modify an option->length field in a DHCPv6 DHCPV6_MESSAGE_INFORMATION_REQUEST input message.
This attack is limited to systems connected to the same network segment as the attacker. 
CVE-2023-356288.1CRITICALRemote Code ExecutionThis vulnerability arises on account of Windows MSHTML Platform.

The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane.

This could result in the attacker executing remote code on the victim’s machine.
CVE-2023-356418.8CRITICALRemote Code ExecutionThis threat affects the Internet Connection Sharing (ICS).

To exploit this vulnerability, an attacker would need to send a maliciously crafted DHCP message to a server that runs the Internet Connection Sharing service.

This attack is limited to systems connected to the same network segment as the attacker

KB5033373 for Windows 10 version 1607 – Changelog

The following changes are part of the KB5033373 cumulative update for Windows 10 version 1607:

  • This update affects the Netherlands time zone. It adds the recent man-made landmass outside of Rotterdam to the shape files.
  • This update addresses security issues for your Windows operating system. 

December 2023 Cumulative or Security Updates

November 2023 Cumulative or Security Updates

October 2023 Security Updates

You may be interested in reading more about other October 2023 security or cumulative updates shared below:

Rajesh Dhawan

Rajesh Dhawan is a technology professional who loves to write about Cyber-security events and stories, Cloud computing and Microsoft technologies. He loves to break complex problems into manageable chunks of meaningful information.

LinkedIn