Google plugs Chrome Zero-Day hole that is actively being exploited in the wild.

This is said to be a heap buffer overflow flaw in the WebRTC framework according to Google.

A heap buffer overflow is a software code vulnerability that can be faulted or exploited by a bad actor, which can cause unintended consequences including a blue screen of death (BSOD, unauthorized access, or Denial of Service (DoS). The overflow generally occurs when the allotted storage capacity is exceeded by the volume of data.

More can be read at thehackernews.com here:

Apple patches Zero-Day vulnerabilities to iOS, macOS and Safari

https://thehackernews.com/2023/12/zero-day-alert-apple-rolls-out-ios.html

https://support.apple.com/en-us/HT201222

November, 2023 Patch Tuesday addresses 63 vulnerabilities; five of them are zero days.

https://thehackernews.com/2023/11/alert-microsoft-releases-patch-updates.html

Zero-Day in Progress MOVEit file transfer software allows SQL Injection attack to gain access, create files, and data exfiltration

There are ~2,500 MOVEit servers available on the internet as of 6/1/2023. This is still developing. There are plenty of sources out there and it looks like these attacks started as resent as 5/27/2023.

https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response

https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/

https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/

Twitter bug (now fixed) allowed “legacy” Blue Checkmark users to get them back for free.

https://www.bleepingcomputer.com/news/technology/twitter-bug-lets-legacy-verified-accounts-get-the-blue-check-back/

Chrome patches Zero-Day where a malicious page can run arbitrary code in the browser. Exploit(s) in the wild.

https://www.theregister.com/2023/04/17/chrome_emergency_patch/

If you haven’t patched GoAnywhere Managed File Transfer (MFT) do it right now (Though it might be too late).

https://www.securityweek.com/goanywhere-zero-day-attack-hits-major-orgs/

SSL-VPN zero-day vulnerability

Anyone else seeing other impacted products? What else is vulnerable to ” heap-based buffer overflow vulnerability [CWE-122]”

Bad actors “actively” exploiting Zero-Day vulnerability in Citrix ADC/Gateway. Citrix releases patch.

https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-citrix-adc-and-gateway-zero-day-patch-now/

Google releases patch for another zero-day in Chrome

https://thehackernews.com/2022/11/update-chrome-browser-now-to-patch-new.html

thehackernews.com