Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure all devices using Google Chrome have the latest version(s) installed
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
|
|
Multiple vulnerabilities have been discovered in Mozilla Products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
References
Multiple vulnerabilities have been discovered in PHP, the most severe of which could allow for remote code execution. PHP is a programming language originally designed for use in web-based applications with HTML content. Successful exploitation could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the service account an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Service accounts configured to have fewer user rights on the system could be less impacted than those with administrative user rights.
Affected Systems:
Risk
Remediation Recommendations
Ensure PHP is updated to its latest version
Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)
References
A group of researchers disclosed a vulnerability in a Kia web portal that could give an attacker remote control over vehicle functions using only a license plate number, WIRED reports. The attacker could exploit the flaw to reassign themselves as an owner of a vehicle, allowing them to unlock the car, start its ignition, or passively track its location. The researchers note, "These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription." WIRED says Kia appears to have patched the flaw.
Researchers at Wiz have disclosed a critical vulnerability (CVE-2024-0132) affecting NVIDIA Container Toolkit and GPU Operator. The flaw affects any AI application that uses the toolkit to enable GPU support. NVIDIA issued a patch on September 26th.
Wiz stated, "The vulnerability enables attackers who control a container image executed by the vulnerable toolkit to escape from that container and gain full access to the underlying host system, posing a serious risk to sensitive data and infrastructure." The researchers add, "The urgency with which you should fix the vulnerability depends on the architecture of your environment and the level of trust you place in running images. Any environment that allows the use of third-party container images or AI models – either internally or as-a-service – is at higher risk given that this vulnerability can be exploited via a malicious image."