Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

CISA Urges Organizations to Patch Recent Firefox Zero-Days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday announced the inclusion of 11 security holes in its Known Exploited Vulnerabilities Catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday announced the inclusion of 11 security holes in its Known Exploited Vulnerabilities Catalog.

CISA created the list – which now contains roughly 500 flaws – to help federal agencies prioritize patching within their environments. CISA told SecurityWeek it has evidence of in-the-wild exploitation for all of the security issues on the list.

The most recent of the newly added bugs are two zero-day vulnerabilities in Firefox, for which Mozilla issued an emergency update over the weekend.

Tracked as CVE-2022-26485 and CVE-2022-26486 and rated “critical severity,” the security holes are described as use-after-free issues. This type of flaw usually leads to arbitrary code execution.

Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, and Focus 97.3.0 address the bugs and federal agencies have until March 21 to update to a patched version. By default, Firefox is configured to automatically install updates and manual patching is required only if this default setting is disabled.

On Monday, CISA also added to its ‘Must-Patch’ list a vulnerability in VMware vCenter Server and Cloud Foundation Server. Tracked as CVE-2021-21973 (CVSS score of 5.3), the issue was addressed in February 2021.

The security error is described as “an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin.” To exploit the issue, an attacker with access to port 443 can send a POST request to the vCenter Server plugin.

While patches for this bug should be installed by March 21, federal agencies have until September 7 to resolve the remaining 8 flaws that were added to the Known Exploited Vulnerabilities Catalog this week.

Advertisement. Scroll to continue reading.

These vulnerabilities are even older and they affect Pulse Connect Secure, Atlassian Jira, NETGEAR routers, Adobe ColdFusion, and Adobe BlazeDS.

While CISA’s Must-Patch catalog and the accompanying Binding Operational Directive (BOD) 22-01 are aimed at federal agencies, organizations of all types are advised to review the list and address the issues on it as soon as possible.

Related: CISA Says Recent Cisco Router Vulnerabilities Exploited in Attacks

Related: CISA Urges Organizations to Patch Actively Exploited Zimbra XSS Vulnerability

Related: CISA Warns of Attacks Exploiting Recent Vulnerabilities in Zabbix Monitoring Tool

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.