Velma recommends...
Known Vulnerabilities This Month:
CVE-2024-4761 | Chrome Web Browser Out-of-Bounds Write Bug
The high-severity vulnerability, tracked as CVE-2024-4761, is an out-of-bounds write bug impacting the V8 JavaScript and WebAssembly engine. It was reported anonymously on May 9, 2024. Out-of-bounds write bugs could be typically exploited by malicious actors to corrupt data, or induce a crash or execute arbitrary code on compromised hosts. “Google is aware that an exploit for CVE-2024-4761 exists in the wild”.
CVE-2024-30040 | Windows MSHTML Platform Security Feature Bypass Vulnerability
An unauthenticated attacker who successfully exploited this vulnerability could gain code execution through convincing a user to open a malicious document at which point the attacker could execute arbitrary code in the context of the user,” the tech giant said in an advisory for CVE-2024-30040.
CVE-2024-30051 | Windows Desktop Window Manager Flaw
CVE-2024-30051 could allow a threat actor to gain SYSTEM privileges. Three groups of researchers from Kaspersky, DBAPPSecurity WeBin Lab, Google Threat Analysis Group, and Mandiant have been credited with discovering and reporting the flaw, indicating likely widespread exploitation.
CVE-2024-4367 | Mozilla Firefox Arbitrary Code Execution
The Center for Internet Security (CIS) released an advisory about this vulnerability, which states that successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users that are configured to have fewer rights on the system could be less impacted than those that operate with administrative user rights. CVE-2024-4367 applies to Mozilla PDF.js, a PDF viewer built in to Mozilla Firefox.
