https://pwn.watch/t/electron Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 13 Sep 2023 00:00:00 GMT https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 https://pwn.watch/i/libwebp-heap-overflow-cve-2023-4863 Wed, 13 Sep 2023 00:00:00 GMT high <p>A heap overflow in libwebp's lossless decoder, found by Apple SEAR and Citizen Lab after the BLASTPASS iPhone exploit, was exploited in the wild. Because libwebp is everywhere, browsers, Electron apps and image libraries that bundle it all had to ship updates.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Chrome 116.0.5845.187, libwebp 1.3.2, Bundling apps/libraries: see each vendor's advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-13: CISA adds CVE-2023-4863 to the KEV catalog</li><li>2023-09-11: Chrome stable update fixes CVE-2023-4863; Google says an exploit exists in the wild (<a href="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-4863</p> https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023 https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023 Thu, 20 Apr 2023 00:00:00 GMT critical <p>Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory</p> <p><strong>Latest updates:</strong></p><ul><li>2023-04-20: Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another (<a href="https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise">source</a>)</li><li>2023-03-30: 3CX confirms the compromise and tells customers to uninstall the Electron desktop app (<a href="https://www.3cx.com/blog/news/desktopapp-security-alert/">source</a>)</li><li>2023-03-29: CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines (<a href="https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-29059</p>