Menu
This article covers recent vulnerabilities found to be actively exploited. They are categorised based not only on the category of exploitation, but their impact, and versions affected. This article also informs on any official fix and remediation guidance for the listed vulnerabilities.
Category: Memory Access Violation
The following platforms are known to be affected:
Google Chrome for Windows, macOS and Linux
NOTE: Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi may also be vulnerable are also advised to apply the fixes as and when they become available.
There is a ‘Use after free’ memory management vulnerability in the Visuals subsystem in Google Chrome prior to 124.0.6367.202.
Use-after-free errors have two common and sometimes overlapping causes:
The memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process.
Google addressed the problem with the release of 124.0.6367.201/.202 for Mac/Windows and 124.0.6367.201 for Linux, with the updates rolling out over the coming days. Affected organisations are encouraged to review the Chrome Release 124.0.6367.201 advisory and apply the necessary updates to the latest release.
Chrome updates automatically when a security update is released, but customers can confirm that they are running the latest version by going to Settings > About Chrome, letting the update finish, and then clicking on the ‘Relaunch’ button to apply the update.
NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.
Category: Buffer Overflow
The Microsoft DWM Core Library contains an input validation failure vulnerability. Manipulation with an undisclosed malicious input payload leads to an overflow of the system’s heap memory. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Customers are advised to upgrade to the latest version of Microsoft Windows via one of the following methods:
NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.
Category: Bypass Or Failure Of Protection Mechanism
The Microsoft Windows MSHTML Platform contains an input improper input validation (CWE-20) vulnerability, exploit of which allows attackers to circumvent Object Linking and Embedding (OLE) mitigations that protect against malicious COM/OLE controls. When OLE protection mechanisms fail or can be bypassed, an attacker is able to embed or import arbitrary (malicious) code and have it executed within the target application’s (trusted) execution context, leading to arbitrary code execution.
An attacker would have to convince the user to load a malicious file onto a vulnerable system, typically by way of an enticement in an Email or Instant Messenger message, and then convince the user to manipulate the specially crafted file, but not necessarily click or open the malicious file.
Customers are advised to upgrade to the latest version of Microsoft Windows via one of the following methods:
NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.
Category: Buffer Overflow
The following platforms are known to be affected:
NOTE: This vulnerability could also affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
An out of bounds write vulnerability exists in the V8 JavaScript and WebAssembly engine in Google Chrome prior to 124.0.6367.207. An out-of-bounds write occurs when a program writes data outside the memory boundaries allocated to it. In the case of CVE-2024-4761, an attacker could exploit the bug by creating a crafted HTML page. When a user visits this page, the exploit manipulates memory in a way that bypasses Chrome’s security protections. Additional details about the nature of the vulnerability have been withheld by Google at this time to prevent more threat actors from weaponizing the flaw.
Users are recommended to upgrade to Chrome version 124.0.6367.207/.208 for Windows and macOS, and version 124.0.6367.207 for Linux. In the coming weeks, Google will release Extended Stable channel version 124.0.6367.207 for Mac and Windows.
Chrome typically updates automatically, but users can manually check for updates by navigating to “Settings” > “About Chrome”.
Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.
NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.
Category: Credential Management
An information disclosure issue exists in D-LINK-DIR-605 B2 devices. An attacker can obtain a user name and password by forging a POST request to the /getcfg.php configuration page in order to retrieve the device credentials and other system information.
Vendor patches may be available for later firmware revisions. However, this vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions since they may are no longer receiving security updates and are likely subject to additional unpatched vulnerabilities.
Category: Cross-Site Request Forgery (‘CSRF’)
Multiple cross-site request forgery (CSRF) vulnerabilities exist in D-Link DIR-600 routers, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform one of a number of exploits, depending on the request hijacked.
Exploit allow remote attackers to hijack the authentication of administrators for requests that:
A fix is available in release v 2.17b02. However, this vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions since they may are no longer receiving security updates and are likely subject to additional unpatched vulnerabilities.
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).
No software to download or install.
Contact us or call us 0113 887 8380
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network and cloud infrastructure. AppCheck are authorized by te Common Vulnerabilities and Exposures (CVE) Program aas a CVE Numbering Authority (CNA)
