The Cybersecurity and Infrastructure Security Agency has updated its Known Exploited Vulnerabilities catalog to include three security flaws in Microsoft and one vulnerability in iOS amid ongoing active exploitation, BleepingComputer reports.
Threat actors could leverage CVE-2023-21823 and CVE-2023-23376 to achieve remote code execution and privilege escalation on vulnerable Windows systems, respectively, while Microsoft Office macro policies could be evaded with the exploitation of CVE-2023-21715. All of the newly added Microsoft zero-day flaws in CISA's KEV catalog have been addressed as part of this month's Patch Tuesday.
CISA has also added an Apple WebKit type confusion flaw, tracked as CVE-2023-23529, which could be leveraged to enable arbitrary code execution. Apple has similarly issued fixes for the flaw, which affects Macs running macOS Ventura, iPhone 8 and later, and all iPad Pro models, earlier this week.
Inclusion of the vulnerabilities should prompt all federal agencies to implement patches until March 7. All organizations across the U.S. have also been strongly urged to apply the fixes.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.