The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
21 Nov 2024 Apple Multiple Products Cross-site scripting
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
- Weakness
- CWE-79
21 Nov 2024 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
24 Oct 2024 Roundcube Webmail Cross-site scripting
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.6.7, roundcube webmail 1.5.7
- CISA due date
- 14 Nov 2024
- Weakness
- CWE-79
15 Oct 2024 Mozilla Firefox Memory corruption
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- mozilla firefox 131.0.2, mozilla firefox 128.3.1, mozilla thunderbird 128.3.1, mozilla firefox 115.16.1, mozilla thunderbird 115.16.0
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-416
On Hacker News
Firefox use-after-free RCE9 Sep 2024 Linux Kernel Memory corruption
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 4.0.2, linux kernel 3.19.7, linux kernel 3.18.14, linux kernel 3.16.35, linux kernel 3.14.41 and 4 older
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-119
9 Sep 2024 ImageMagick Input validation flaw
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-20
21 Aug 2024 Linux Kernel Memory corruption
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- linux kernel 5.16.2, linux kernel 5.15.16, linux kernel 5.10.93, linux kernel 5.4.173
- CISA due date
- 11 Sep 2024
- Weakness
- CWE-190
7 Aug 2024 Android Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 6.9.4, linux kernel 6.6.34, linux kernel 6.1.94, linux kernel 5.15.161, linux kernel 5.10.219 and 2 older
- CISA due date
- 28 Aug 2024
- Weakness
- CWE-416
17 Jul 2024 Adobe Commerce and Magento Open Source XML external entity
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe commerce webhooks 1.5.0
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-611
26 Jun 2024 Linux Kernel Memory corruption
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- siemens simatic s7-1500 tm mfp firmware 1.1, linux kernel 5.19.2, linux kernel 5.18.18, linux kernel 5.15.61, linux kernel 5.10.137 and 4 older
- CISA due date
- 17 Jul 2024
- Weakness
- CWE-416
26 Jun 2024 Roundcube Webmail Cross-site scripting
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.4.5, roundcube webmail 1.3.12
- CISA due date
- 17 Jul 2024
- Weakness
- CWE-80
12 Jun 2024 PHP Group PHP Command injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- php 8.3.8, php 8.2.20, php 8.1.29
- CISA due date
- 3 Jul 2024
- Weakness
- CWE-78
1 May 2024 GitLab CE/EE Authentication bypass
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- gitlab 16.7.2, gitlab 16.6.4, gitlab 16.5.6, gitlab 16.4.5, gitlab 16.3.7 and 2 older
- CISA due date
- 22 May 2024
- Weakness
- CWE-284
On Hacker News
POC of Gitlab Account-Take-Over CVE-2023-702812 Feb 2024 Roundcube Webmail Cross-site scripting
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.6.3, roundcube webmail 1.5.4, roundcube webmail 1.4.14
- CISA due date
- 4 Mar 2024
- Weakness
- CWE-79
6 Feb 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 116.0.5845.179, microsoft edge chromium 116.0.1938.76
- CISA due date
- 27 Feb 2024
- Weakness
- CWE-843
16 Jan 2024 Laravel Framework Remote code execution
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 6 Feb 2024
- Weakness
- CWE-502
2 Jan 2024 Spreadsheet::ParseExcel Remote code execution
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 23 Jan 2024
- Weakness
- CWE-95
2 Jan 2024 Google Chromium WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 120.0.6099.129
- CISA due date
- 23 Jan 2024
- Weakness
- CWE-787
4 Dec 2023 Apple Multiple Products Memory corruption
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Fixed in (NVD)
- apple safari 17.1.2, apple ipados 17.1.2, apple iphone os 17.1.2, apple ipados 16.7.3, apple iphone os 16.7.3 and 4 older
- CISA due date
- 25 Dec 2023
- Weakness
- CWE-787
4 Dec 2023 Apple Multiple Products Memory corruption
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Fixed in (NVD)
- apple safari 17.1.2, apple ipados 17.1.2, apple iphone os 17.1.2, apple ipados 16.7.3, apple iphone os 16.7.3 and 4 older
- CISA due date
- 25 Dec 2023
- Weakness
- CWE-125
30 Nov 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 119.0.6045.199, microsoft edge chromium 119.0.2151.97
- CISA due date
- 21 Dec 2023
- Weakness
- CWE-190
21 Nov 2023 GNU C Library Memory corruption
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- siemens simatic s7-1500 tm mfp firmware 1.1, gnu glibc 2.39
- CISA due date
- 12 Dec 2023
- Weakness
- CWE-122
2 Nov 2023 Apache ActiveMQ Remote code execution
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache activemq 5.18.3, apache activemq legacy openwire module 5.18.3, apache activemq 5.17.6, apache activemq legacy openwire module 5.17.6, apache activemq 5.16.7 and 3 older
- CISA due date
- 23 Nov 2023
- Weakness
- CWE-502
26 Oct 2023 Roundcube Webmail Cross-site scripting
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.6.4, roundcube webmail 1.5.5, roundcube webmail 1.4.15
- CISA due date
- 16 Nov 2023
- Weakness
- CWE-79
25 Sep 2023 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.0.1, apple iphone os 17.0.1, apple macos 14.0, webkitgtk+ 2.42.2
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-754
13 Sep 2023 Google Chromium WebP Memory corruption
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- bentley seequent leapfrog 2023.2, mozilla firefox 117.0.1, google chrome 116.0.5845.187, microsoft edge chromium 116.0.1938.81, mozilla thunderbird 115.2.2 and 7 older
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-787
23 Jun 2023 VMware Tools Authentication bypass
A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware tools 12.2.5
- CISA due date
- 14 Jul 2023
- Weakness
- CWE-287
22 Jun 2023 Roundcube Webmail SQL injection
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- roundcube webmail 1.4.12, roundcube webmail 1.3.17
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-89
22 Jun 2023 Roundcube Webmail Cross-site scripting
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- roundcube webmail 1.4.10, roundcube webmail 1.3.16, roundcube webmail 1.2.13
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-79
22 Jun 2023 Roundcube Webmail Command injection
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- roundcube webmail 1.4.4, roundcube webmail 1.3.11, roundcube webmail 1.2.10
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-78
22 Jun 2023 Mozilla Firefox, Firefox ESR, and Thunderbird Memory corruption
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 50.0.2, mozilla thunderbird 45.5.1, mozilla firefox 45.5.1
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-416
7 Jun 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 114.0.5735.110, couchbase server 7.1.5
- CISA due date
- 28 Jun 2023
- Weakness
- CWE-843
12 May 2023 Red Hat Polkit Access control flaw
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- polkit project polkit 0.119
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-863
12 May 2023 Apache Tomcat Access control flaw
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 8.5.7, apache tomcat 8.0.39, apache tomcat 7.0.73, apache tomcat 6.0.48
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Oracle Java SE and JRockit Access control flaw
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache cassandra 3.11.8, apache cassandra 3.0.22, apache cassandra 2.2.18, apache cassandra 2.1.22
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Linux Kernel Race condition
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 3.14.4, linux kernel 3.12.20, linux kernel 3.10.40, linux kernel 3.4.91, linux kernel 3.2.59
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-362
12 May 2023 Linux Kernel Input validation flaw
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 2.6.36
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-20
21 Apr 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.137
- CISA due date
- 12 May 2023
- Weakness
- CWE-190
On Hacker News
Google Chrome Zero-Day 1 comment17 Apr 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.121, couchbase server 7.1.5
- CISA due date
- 8 May 2023
- Weakness
- CWE-843
30 Mar 2023 Linux Kernel Memory corruption
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 6.1.6, linux kernel 5.15.88, linux kernel 5.10.163, linux kernel 5.4.229, linux kernel 4.19.270 and 1 older
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
30 Mar 2023 Samba Remote code execution
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- samba 4.6.4, samba 4.5.10, samba 4.4.14, samba 4.4.0
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-94
10 Mar 2023 XStream Remote code execution
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- xstream 1.4.18
- CISA due date
- 31 Mar 2023
- Weakness
- CWE-94, CWE-502
20 Oct 2022 Linux Kernel Access control flaw
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- canonical ubuntu linux 20.10, canonical ubuntu linux 20.04, canonical ubuntu linux 18.04
- CISA due date
- 10 Nov 2022
- Weakness
- CWE-862
15 Sep 2022 Linux Kernel Input validation flaw
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.5.5, linux kernel 3.4.12, linux kernel 3.2.54
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-20
15 Sep 2022 Linux Kernel Memory corruption
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
15 Sep 2022 Linux Kernel Security flaw
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
25 Aug 2022 PEAR Archive_Tar Path traversal
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.1.3, drupal 9.0.11, drupal 8.9.13, drupal 7.78
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-59
25 Aug 2022 PEAR Archive_Tar Input validation flaw
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.0.9, drupal 8.9.10, drupal 8.8.12, drupal 7.75, php archive tar 1.4.12
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-74
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 15.6.1, apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, webkitgtk 2.36.7 and 1 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
9 Aug 2022 RARLAB UnRAR Path traversal
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rarlab unrar 6.12
- CISA due date
- 30 Aug 2022
- Weakness
- CWE-22, CWE-59
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.