The liability rules allow for compensation for damage when manufacturers fail to address cybersecurity vulnerabilities
Monthly Archives: September 2022
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
ZDI-22-1325: SolarWinds Network Performance Monitor UpdateActionsDescriptions SQL Injection Privilege Escalation Vulnerability
This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability.
Possible New Microsoft Exchange RCE 0-day Being Exploited in the Wild
Note: This is a breaking news event. All information and updates related to this event will be updated once relevant information is available. FortiGuard Labs is aware of reports that an unpatched Microsoft Exchange vulnerability is being exploited in the wild. It is a Remote Command Execution (RCE) vulnerability, as such successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. At the time of this writing, patches and CVE assignments are not available. Also, Microsoft has not commented or confirmed that this is a zero day vulnerability.Why is this Significant?This is significant because this is likely a new unpatched Remote Command Execution (RCE vulnerability). Successful exploitation could allow an attacker to execute remote commands on affected Microsoft Exchange servers. Microsoft Exchange is widely used in Enterprise and an unpatched vulnerability poses a serious threat to many organizations worldwide.When was the Vulnerability Discovered?On September 28, 2022, GTSC (security vendor) published a blog on an unpatched Microsoft Exchange vulnerability which was leveraged in an attack against an unnamed critical infrastructure. Has Microsoft Released a Patch for the Vulnerability?At the time of this writing (September 29, 2022), Microsoft has not released a patch for the vulnerability.Has the Vendor Released an Advisory for the Vulnerability?No, Microsoft has not released an advisory at the time of this writing (September 29, 2022). Microsoft has yet to confirm that this is a new zero-day or vulnerability.What is the Status of Coverage?FortiGuard Labs is closely monitoring the situation and will update this Threat Signal once protections are available. All network IOCs on the GTSC blog are blocked by the WebFiltering client.What Mitigation Steps are Available?GTSC provided potential detection and mitigation information in their blog. Note that those detection and mitigation have not been verified by FortiGuard Labs. For additional information, see the Appendix for a link to “WARNING: NEW ATTACK CAMPAIGN UTILIZED A NEW 0-DAY RCE VULNERABILITY ON MICROSOFT EXCHANGE SERVER”.
dotnet6.0-6.0.108-3.fc37
FEDORA-2022-71d7164d42
Packages in this update:
dotnet6.0-6.0.108-3.fc37
Update description:
This is the monthly update for .NET for August 2022. This updates the .NET SDK to 6.0.108 and .NET Runtime to 6.0.8.
This update includes a fix for CVE 2022-34716.
dotnet3.1-3.1.423-1.fc35
FEDORA-2022-847c67b3cd
Packages in this update:
dotnet3.1-3.1.423-1.fc35
Update description:
Update to the September 2022 update release of .NET Core 3.1
Release Notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.29/3.1.29.md
This includes a fix for CVE-2022-38013
dotnet3.1-3.1.423-1.fc36
FEDORA-2022-980d492c98
Packages in this update:
dotnet3.1-3.1.423-1.fc36
Update description:
Update to the September 2022 update release of .NET Core 3.1
Release Notes: https://github.com/dotnet/core/blob/main/release-notes/3.1/3.1.29/3.1.29.md
This includes a fix for CVE-2022-38013
gitqlient-1.5.0-2.el8
FEDORA-EPEL-2022-f70a782e69
Packages in this update:
gitqlient-1.5.0-2.el8
Update description:
Update to latest version
gitqlient-1.5.0-2.fc36
FEDORA-2022-784d729f30
Packages in this update:
gitqlient-1.5.0-2.fc36
Update description:
Update to latest version
thunderbird-102.3.1-1.fc36
FEDORA-2022-df4ffc6551
Packages in this update:
thunderbird-102.3.1-1.fc36
Update description:
Update to 102.3.1
https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/
https://www.thunderbird.net/en-US/thunderbird/102.3.1/releasenotes/