Med-Mastodon

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"⚠️ Alert: Google Chrome Zero-Day CVE-2023-7024 Exploited in the Wild! 🌐💥"Google's latest patch addresses a critical zero-day vulnerability in Chrome, CVE-2023-7024. Identified as a heap-based buffer overflow in WebRTC, it's exploited in the wild. Chrome versions before 120.0.6099.129 are vulnerable. 🚨Details: CVE-2023-7024, discovered by Google TAG, affects several browsers using WebRTC. It's the eighth zero-day patched by Google this year, underscoring the evolving cybersecurity landscape.Mitigation: Users should urgently update to Chrome 120.0.6099.129/130 (for Windows) or 120.0.6099.129 (for Mac/Linux) to protect against this and other security fixes included in recent Chrome updates. 🛡️Source: <a href="https://threatprotect.qualys.com/2023/12/21/google-chrome-zero-day-vulnerability-exploited-in-the-wild-cve-2023-7024/" rel="nofollow noopener" target="_blank">Qualys ThreatPROTECT</a> by Diksha Ojha; <a href="https://chromereleases.googleblog.com/2023" rel="nofollow noopener" target="_blank">Chrome Releases Blog</a>Tags: <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/GoogleChrome" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoogleChrome</a> <a href="https://infosec.exchange/tags/ZeroDay" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZeroDay</a> <a href="https://infosec.exchange/tags/CVE2023" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE2023</a> <a href="https://infosec.exchange/tags/WebRTC" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebRTC</a> <a href="https://infosec.exchange/tags/UpdateNow" class="mention hashtag" rel="nofollow noopener" target="_blank">#UpdateNow</a> <a href="https://infosec.exchange/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberAttack</a> <a href="https://infosec.exchange/tags/InfoSecExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSecExchange</a>

🛡 H3lium@infosec.exchange/:~# :blinking_cursor:"🚨 <a href="https://infosec.exchange/tags/CitrixHypervisor" class="mention hashtag" rel="nofollow noopener" target="_blank">#CitrixHypervisor</a> Security Alert! 🚨"Citrix has identified several security issues in Citrix Hypervisor 8.2 CU1 LTSR that could potentially compromise system security. These issues include AMD-based host compromise through a PCI device (CVE-2023-34326), host compromise with specific administrative actions (CVE-2022-1304), host crashes or unresponsiveness (CVE-2023-34324), and crashing of other VMs on AMD-based hosts (CVE-2023-34327). Additionally, a security problem affecting certain AMD CPUs, which may allow code in a guest VM to access previous integer divides in code running on the same CPU core, has been disclosed as CVE-2023-20588.Mitigating factors include the dependency on AMD CPUs and the use of specific features. Customers not using AMD CPUs or PCI passthrough features may not be affected by some of these issues.Citrix has released multiple security updates for Citrix Hypervisor 8.2 CU1 LTSR. Several vulnerabilities have been discovered:<ol><li>CVE-2023-34326: A threat that allows malicious privileged code in a guest VM to compromise an AMD-based host via a passed-through PCI device.</li><li>CVE-2022-1304: A vulnerability that can compromise the host when a specific administrative action is taken.</li><li>CVE-2023-34324: A flaw that can cause the host to crash or become unresponsive.</li><li>CVE-2023-34327: A vulnerability that can cause a different VM running on the AMD-based host to crash.</li><li>CVE-2023-20588: A security issue affecting certain AMD CPUs, allowing code in a guest VM to determine values from previous integer divides in code running on the same CPU core.</li></ol>Citrix has provided hotfixes for these vulnerabilities. Affected users are advised to install these updates and follow the provided instructions. For more details, check the official Citrix article <a href="https://support.citrix.com/article/CTX575089" rel="nofollow noopener" target="_blank">here</a>.Tags: <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/Citrix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Citrix</a> <a href="https://infosec.exchange/tags/Hypervisor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hypervisor</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/AMD" class="mention hashtag" rel="nofollow noopener" target="_blank">#AMD</a> <a href="https://infosec.exchange/tags/CVE2023" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE2023</a> <a href="https://infosec.exchange/tags/CVE2022" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE2022</a> <a href="https://infosec.exchange/tags/SecurityUpdates" class="mention hashtag" rel="nofollow noopener" target="_blank">#SecurityUpdates</a> 🛡️🔧

Ian Towner :donor:<a href="https://infosec.exchange/tags/keepass" class="mention hashtag" rel="nofollow noopener" target="_blank">#keepass</a> discussion on password exporting without explicitly entering the master password:<a href="https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/" rel="nofollow noopener" target="_blank">https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/</a>CVE details: <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-24055" rel="nofollow noopener" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2023-24055</a>I’ve not tried this out yet but it doesn’t sound great, the premise that admin access to your computer should mean compromise of all passwords in keepass vault is pretty ridiculous!<a href="https://infosec.exchange/tags/cve" class="mention hashtag" rel="nofollow noopener" target="_blank">#cve</a>-2023-24055 <a href="https://infosec.exchange/tags/cve2023" class="mention hashtag" rel="nofollow noopener" target="_blank">#cve2023</a>-24055

Recent searches

Search options

Administered by:

Server stats:

#cve2023