https://pwn.watch/t/justice-av-solutions Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 29 May 2024 00:00:00 GMT https://pwn.watch/i/justice-av-solutions-viewer-cve-2024-4978 https://pwn.watch/i/justice-av-solutions-viewer-cve-2024-4978 Wed, 29 May 2024 00:00:00 GMT high <p>Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server. Added to the CISA KEV catalog on 2024-05-29.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-05-29: CISA added CVE-2024-4978 to the KEV catalog (federal deadline 2024-06-19) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-05-23: CVE-2024-4978 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-4978">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-4978</p>