Zero-days - Securezoo

Sophos Firewall RCE vulnerability (CVE-2022-3236) exploited the wild

Network Security, Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 23, 2022 September 23, 2022 / CISA, CVE-2022-3236, Firewall, Sophos, Webadmin, Zoho

Sophos has fixed a Sophos Firewall remote code execution (RCE) vulnerability (CVE-2022-3236) exploited in the wild.

Apple patches vulnerabilities in iOS 16, iOS 15.7, macOS Monterey 12.6, Big Sur 11.7 and other products

Mobile Security, Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 14, 2022 September 14, 2022 / Big Sur, CVE-2022-32894, CVE-2022-32917, iOS, iOS157, iOS16, macOS, Monterey126

Apple has released security updates for Apple iOS 16, iOS 15.7, macOS Monterey 12.6, macOS Big Sur 11.7, Safari 15.6, and other products. Apple also warned two zero-day vulnerabilities may have been exploited in the wild.

Microsoft September 2022 Security Updates addresses 63 vulnerabilities (5 Critical, 1 zero-day, 1 Spectre-BHP)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 14, 2022 September 15, 2022 / CVE-2022-34700, CVE-2022-34718, CVE-2022-34721, CVE-2022-34722, CVE-2022-35805, CVE-2022-37969, Cybersecurity Threat Center, Microsoft, Spectre v2, Spectre-BHP

The Microsoft September 2022 Security Updates includes patches and advisories for 63 vulnerabilities. Five of those are rated Critical severity, one that addresses a previously disclosed Spectre-BHP flaw, and a zero-day exploited in the wild.

CISA adds 12 vulnerabilities to Known Exploited Vulnerabilities Catalog

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 11, 2022 September 11, 2022 / Android, Apple, Chrome, CVE-2022-26258, CVE-2022-27593, CVE-2022-28958, CVE-2022-3075, D-Link, FortiOS, MikroTik, Oracle, QNAP, QNAP NAS, WebLogic

The Cybersecurity and Infrastructure Security Agency (CISA) has added 12 vulnerabilities to its Known Exploited Vulnerabilities Catalog, to include Apple, Chrome, Android OS, D-Link (5), QNAP NAS, MikroTik, Oracle WebLogic, FortiOS and FortiADC flaws.

Google fixes Chrome zero-day vulnerability (CVE-2022-3075) exploited in the wild

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 5, 2022 September 5, 2022 / browser, Chrome, Chrome105, CVE-2022-3075, Vulnerabilities

Google has released Chrome 105.0.5195.102 for Windows, Mac and Linux with a fix for a High severity zero-day vulnerability (CVE-2022-3075) exploited in the wild.

Apple fixes zero-day vulnerability (CVE-2022-32893) in iOS 12.5.6 exploited in the wild

Mobile Security, Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / September 2, 2022 September 2, 2022 / Apple, CVE-2022-32893, Exploit, iOS, Vulnerabilities, Webkit, Zero-day

Apple has fixed a zero-day vulnerability (CVE-2022-32893) in iOS 12.5.6 under attack in the wild.

Apple fixes 2 zero-days (CVE-2022-32894 and CVE-2022-32893) in iOS 15.6.1 and macOS Monterey 12.5.1 (update now!)

Mobile Security, Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / August 19, 2022 August 19, 2022 / CVE-2022-32893, CVE-2022-32894, iOS, iOS15.6.1, macOS, macOS Monterey 12.5.1

Apple has released security updates for Apple iOS 15.6.1, iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. The updates include fixes for two zero-day vulnerabilities (CVE-2022-32894 and CVE-2022-32893) under attack in the wild.

Google releases Chrome 104 security update with fixes for 11 vulnerabilities (1 zero-day CVE-2022-2856)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / August 19, 2022 August 19, 2022 / Chrome, CVE-2022-2856, Vulnerabilities, Zero-day

Google has released Chrome 104.0.5112.101 (Mac/Linux) and 104.0.5112.102/101 (Windows), with fixes for 11 vulnerabilities (one rated Critical and seven rated High severity). Additionally, one of the patches fixed a zero-day flaw CVE-2022-2856.

Microsoft August 2022 Security Updates addresses 121 vulnerabilities (17 Critical and 1 zero-day)

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / August 10, 2022 August 10, 2022 / CVE-2022-21980, CVE-2022-24477, CVE-2022-24516, CVE-2022-30133, CVE-2022-33646, CVE-2022-34691, CVE-2022-34696, CVE-2022-34702, CVE-2022-34713, CVE-2022-34714, CVE-2022-35744, CVE-2022-35745, CVE-2022-35752, CVE-2022-35753, CVE-2022-35766, CVE-2022-35767, CVE-2022-35794, CVE-2022-35804, Cybersecurity Threat Center, DogWalk, MSDT

The Microsoft August 2022 Security Updates includes patches and advisories for 121 vulnerabilities, 17 of those rated Critical severity and one zero-day CVE-2022-34713 exploited in the wild.

Knotweed threat actors exploit Microsoft and Adobe 0-days and deliver Subzero malware

Security Updates & Patches, Vulnerabilities & Exploits, Zero-days / By Frank Crast / July 30, 2022 July 30, 2022 / 0-day, Adobe, CVE-2021-28550, CVE-2021-31199, CVE-2021-31201, CVE-2021-36948, CVE-2022-22047, DSIRF, Knotweed, Microsoft, MSTIC, Subzero

Knotweed threat actors have exploited Microsoft and Adobe 0-day vulnerabilities in targeted attacks against European and Central American customers. The actors also developed Subzero malware used in these attacks.