In this week's Security Advisory:
Apple released updates to address several vulnerabilities, including two zero-days that may have been actively exploited in the wild. Both zero-days, CVE-2024-23296 and CVE-2024-23225, are memory corruption issues in the kernel that could allow an attacker to bypass kernel memory protections and execute arbitrary code. Both vulnerabilities received a CVSS score of 7.8 out of a possible 10.
The following products are affected:
More Reading/Information
VMware announced four (4) vulnerabilities in its Fusion, Workstation Player, and Workstation Pro products that could allow for arbitrary code execution. Of the four (4) vulnerabilities, the most severe is being tracked as CVE-2024-22267 and has received a CVSS score of 9.3 out of a possible 10. CVE-2024-22267 is a use-after-free vulnerability in the vbluetooth component that could allow an attacker with administrative privileges on a virtual machine to execute arbitrary code.
The following versions are affected:
VMware has released a workaround for those who cannot immediately apply the patches for these vulnerabilities. Navigate to the following link for more information: https://knowledge.broadcom.com/external/article?legacyId=91760
More Reading/Information
F5 released patches to fix two (2) high-severity vulnerabilities in its BIG-IP Next Central Manager that could lead to an attacker taking over the device. Next Central Manager allows administrators to control all BIG-IP Next instances from a unified management interface. The vulnerabilities, CVE-2024-21793 and CVE-2024-26026, could allow an unauthenticated attacker to execute SQL queries through the BIG-IP Next Central Manager API, allowing the attacker to create new accounts and potentially gain full administrative control of the BIG-IP Next Central Manager device.
The following versions are affected:
More Reading/Information
This month's Patch Tuesday includes fixes for over sixty (60) vulnerabilities, including two (2) actively exploited zero-days. The first zero-day, CVE-2024-30040, allows an unauthenticated attacker to bypass security protections and execute arbitrary code. This zero-day requires that a user opens a malicious document to achieve exploitation. The second zero-day, CVE-2024-30051, is a heap-based buffer overflow that could allow an authenticated attacker to gain SYSTEM-level privilege if exploited. CVE-2024-30040 and CVE-2024-30051 received a CVSS score of 8.8 and 7.8 out of a possible 10, respectively.
More Reading/Information
Google released a patch for its Desktop Browser to address a zero-day that is actively being exploited in the wild. The zero-day is being tracked as CVE-2024-4761 and is an out-of-bounds write issue in the Chrome V8 JavaScript and WebAssembly engine. Successful exploitation can lead to a threat actor executing arbitrary code, gaining access to sensitive data, or causing the user's browser to crash. CVE-2024-4761 has not received a CVSS score.
More Reading/Information
Security updates were released by Mozilla and Adobe to address several vulnerabilities in each product.
Mozilla released security updates to address vulnerabilities that could lead to arbitrary code execution. There was a total of twenty-eight (28) vulnerabilities affecting Firefox, Firefox ESR, and Thunderbird, with four (4) receiving a severity rating of "High". These affect Firefox versions prior to 126, Firefox ESR versions prior to 115.11, and Thunderbird versions prior to 115.11.
Adobe addressed thirty-seven (37) vulnerabilities, with twenty-six (26) vulnerabilities given a severity rating of "Critical". These vulnerabilities affect Adobe Acrobat Reader, Illustrator, Substance3D Painter, Aero, Substance3D Designer, Animate, FrameMaker, and Dreamweaver.
More Reading/Information
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to "vendor-supported versions" only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, Cybersafe strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.