Adobe, Apple, Google & Microsoft Patch 0-Day Bugs

Summary: Microsoft's September 2023 Patch Tuesday fixed at least five dozen Windows vulnerabilities, including two zero-days already being exploited: CVE-2023-36761, an information disclosure flaw in Word that can leak Net-NTLMv2 hashes just by viewing a malicious document in the preview pane, and CVE-2023-36802, an elevation-of-privilege bug in the Microsoft Streaming Service Proxy that grants SYSTEM privileges. Apple patched CVE-2023-41064, a zero-click iOS flaw exploited via malicious iMessage images to install NSO Group spyware, while Google fixed a Chrome heap overflow reported by Apple and Citizen Lab, and Adobe patched a zero-day (CVE-2023-26369) in Reader and Acrobat.
Why it matters: CVE-2023-36761 means a single glance at a malicious Word document in the preview pane can hand an attacker Net-NTLMv2 hashes for impersonation and pass-the-hash attacks, and CVE-2023-38148 lets an unauthenticated attacker install malware by sending one crafted packet to a vulnerable Windows system.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-26369 CVE-2023-36761 CVE-2023-36802 CVE-2023-38148 CVE-2023-41064
Related: Microsoft Patch Tuesday for September 2023 — Unusually low 5 critical vulnerabilities included in Microsoft Patch Tuesday, along with two zero-days Cyber Risks ·
Turns out even the NFL is worried about deepfakes Cyber Risks ·
CVE-2023-26369: Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 14, 2023