The United States Cybersecurity and Facilities Security Firm(CISA)has warned federal firms about an actively made use of zero-day vulnerability in Google’s
Chrome browser. Tracked as CVE-2022-1096, the high-severity security hole was identified in Chrome’s V8 JavaScript engine and impacts all Chromium-based internet browsers.
Google provided an emergency situation repair for this bug on Friday, and Microsoft did the same the next day, upgrading its Chromium-based Edge web browser. CISA has added the zero-day to its Understood Exploited Vulnerabilities Brochure along with 31 other bugs, consisting of a high-severity Redis Server defect now made use of in botnet attacks.
Tracked as CVE-2022-0543, the issue is referred to as a Redis Lua sandbox escape and remote code execution vulnerability that exists since the Lua library in some Debian/Ubuntu packages is provided as a dynamic library.
[ READ: CISA’s’Should Patch’List Puts Spotlight on Vulnerability Management Processes] Scientists at network services provider Juniper say that the Muhstik malware has been making use of the vulnerability in attacks because March 11.
Previously, the botnet’s operators were observed targeting Confluence server, Log4j, and Oracle WebLogic vulnerabilities.
While several of the other vulnerabilities that CISA has simply contributed to its Must Spot list were dealt with in 2021, the remaining are older
bugs, some addressed a decade back. CISA is offering federal agencies three weeks(until April 18)to use patches for these vulnerabilities.
Nevertheless, the firm informed SecurityWeek previously this year that those who stop working to meet the deadlines are not punished. Instead, CISA supplies assistance to companies that can not satisfy the deadlines.
The Known Exploited Vulnerabilities Brochure is mainly for federal firms, however companies of all types are motivated to utilize it to enhance their patching operations . Related: CISA Includes 66 Vulnerabilities to’Should Spot’List Related: CISA Urges Organizations to Patch Current Firefox Zero-Day
Ionut Arghire is a global reporter for SecurityWeek. Previous Columns by Ionut Arghire: Tags: Source
