Apr 9, 2024
1 new incident, 1 with updates.
Started
- ClosedPatched
Microsoft SmartScreen Prompt Security Feature Bypass
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. Added to the CISA KEV catalog on 2024-04-30.
Microsoft SmartScreen PromptClosed Apr 30, 2024
Updated
- ClosedPatched
xz-utils backdoor (CVE-2024-3094)
A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.
XZ Utils (liblzma)Closed May 29, 2024
