tommy456 12 Posted September 14, 2023 Posted September 14, 2023 I Assume ESET is aware of this assumed threat,? And probably will protect the end user against it ? Just seeking confirmation https://www.pcworld.com/article/2068973/serious-vulnerability-found-time-to-update-browser.html New_Style_xd 1
New_Style_xd 71 Posted September 15, 2023 Posted September 15, 2023 1 hora atrás, tommy456 disse: Suponho que a ESET esteja ciente dessa ameaça assumida? E prova protegerá o usuário final contra ele ? Apenas buscando confirmação https://www.pcworld.com/article/2068973/serious-vulnerability-found-time-to-update-browser.html I actually found the same information that is being talked about a lot. https://tecnoblog.net/noticias/2023/09/13/falha-de-seguranca-afeta-chrome-firefox-edge-e-mais-apps/ tommy456 1
itman 1,809 Posted September 16, 2023 Posted September 16, 2023 On 9/14/2023 at 7:48 PM, tommy456 said: I Assume ESET is aware of this assumed threat,? And probably will protect the end user against it ? Just seeking confirmation Bad assumption. Update your Chrome/Edge or Firefox browser to latest version which will apply the needed security patch.
itman 1,809 Posted September 16, 2023 Posted September 16, 2023 (edited) Also, this vulnerability just doesn't affect web browsers; Quote The heap buffer overflow (CVE-2023-4863) vulnerability in the WebP Codec is being actively exploited in the wild. A significant vulnerability in the WebP Codec has been unearthed, prompting major browser vendors, including Google and Mozilla, to expedite the release of updates to address the issue. Update (9/13/2023): So far the Web Browsers that have confirmed a fix and released an update include: Google Chrome[1], Mozilla Firefox[2], Brave[3], Microsoft Edge[4], and Tor Browser[5]. If your browser of choice is using Chromium then expect an update to already be rolled out or will be done shortly. Important: Let me make it perfectly clear that this vulnerability doesn't just affect web browsers, it affects any software that uses the libwebp library. This includes Electron-based applications, for example - Signal. Electron patched the vulnerability yesterday. Also, software like Honeyview (from Bandisoft) released an update to fix the issue. CVE-2023-4863 was falsely marked as Chrome-only by Mitre and other organizations that track CVE's and 100% of media reported this issue as "Chrome only", when it's not. Who uses libwebp? There are a lot of applications that use libwebp to render WebP images, I already mentioned a few of them, but some of the others that I know include: Affinity (the design software), Gimp, Inkscape, LibreOffice, Telegram, Thunderbird (now patched), ffmpeg, and many, many Android applications as well as cross-platform apps built with Flutter. Update (9/14/2023): 1Password for Mac have released an update to address the issue. 1Password (like many others) is an application built with Electron, and until all these apps upgrade to the latest version - they are considered vulnerable based on the severity of the bug. Update (9/15/2023): Okay, so, I thought I would give an update as I have been getting a lot of emails about this, and I can't spend so much time trying to answer each one individually. I know that Telegram Desktop made an update and I have seen Ubuntu, Debian, SUSE and other Linux platforms also actively updating their libwebp versions. I also know that software like Obsidian is going to bump their Electron version https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/ Edited September 16, 2023 by itman
itman 1,809 Posted September 17, 2023 Posted September 17, 2023 Add Opera to the list of affected browsers; Quote Fortified Security with Chromium 116.0.5845.188 (CHR-9416): The cornerstone of Opera 102’s security enhancements is the integration of Chromium version 116.0.5845.188. This update addresses crucial security issues, including CVE-2023-4863, to ensure your browsing sessions are safer than ever. Staying current with Chromium is fundamental for security in today’s digital landscape. https://blogs.opera.com/desktop/2023/09/opera-102-0-4880-51-stable-update/
itman 1,809 Posted September 17, 2023 Posted September 17, 2023 (edited) Also as I suspected, CVE-2023-4863 affects Microsoft software including Windows itself; Quote Reports indicated that the vulnerabilities (CVE-2023-4863, CVE-2023-36761 and CVE-2023-36802) in Microsoft Windows and Server, Microsoft Edge, as well as Microsoft Office, Word and 365 Apps are being exploited in the wild https://www.govcert.gov.hk/en/alerts_detail.php?id=1107 It is therefore imperative that Windows Sept. Cumulative update plus Office and 365 app updates be performed immediately. Edited September 17, 2023 by itman
New_Style_xd 71 Posted September 19, 2023 Posted September 19, 2023 Em 17/09/2023 às 12:36, Itman disse: Também como eu suspeitava, o CVE-2023-4863, por meio do software da Microsoft, incluindo o Windows anterior ; https://www.govcert.gov.hk/en/alerts_detail.php?id = 1107 Portante, é imperativo que o Windows seja setembro. Atualização cumulativa mais atualizações de aplicação do Office e 365 devem ser executadas imediatamente. Obrigado, fiz todas as atualizações disponíveis, acredito que agora estou melhor protegido. 😀
Recommended Posts