Google has released Chrome version 86.0.4240.111 for Windows, Mac and Linux to address several vulnerabilities in its browser, including an actively exploited zero-day flaw.
Tracked as CVE-2020-15999, the vulnerability is described as a heap buffer overflow bug in FreeType rendering engine. The vulnerability “exists in the function `Load_SBit_Png`, which processes PNG images embedded into fonts,” and can be exploited with specifically crafted fonts with embedded PNG images.
In addition to CVE-2020-15999, the new Chrome version also includes patches for high severity flaws in Chrome's Blink rendering engine (CVE-2020-16000), and three use-after-free memory corruption bugs in PDFium (CVE-2020-16002), and the browser's media and printing functions (CVE-2020-16001, CVE-2020-16003).
Microsoft has also issued two out-of-band security updates this week to address remote execution flaws in Windows Codecs Library and Visual Studio Code application.
The first vulnerability, tracked as CVE-2020-17022, resides in Windows Codecs Library and affects all devices running Windows 10, version 1709 or later, and a vulnerable library version. The second bug (CVE-2020-17023) affects the Visual Studio Code application. The successful exploitation requires a hacker convincing a victim to clone a repository and open it in Visual Studio Code. The malicious code would execute when the user opens the malicious 'package.json' file.
Adobe released a batch of security updates that fix multiple vulnerabilities, including high risk flaws across Photoshop, Illustrator, Adobe Creative Cloud Desktop Application, Adobe Premiere Pro, InDesign, and other products.
Adobe Illustrator received a fix for seven issues, five of which (CVE-2020-24411, CVE-2020-24412, CVE-2020-24413, CVE-2020-24414, CVE-2020-24415), if exploited, can lead to arbitrary code execution.
Also, high risk remote code vulnerabilities have been patched in in Adobe Photoshop CC 2019 and Photoshop 2020 (CVE-2020-24420), inDesign (CVE-2020-24421), Adobe Creative Cloud Desktop Application (CVE-2020-24422), Adobe After Effects (CVE-2020-24419), Adobe Premiere Pro (CVE-2020-24424), Adobe Media Encoder (CVE-2020-24423), and Adobe Animate (CVE-2020-9747, CVE-2020-9748, CVE-2020-9749, CVE-2020-9750).
Two high risk bugs have been patched in Mozilla Thunderbird. One of them (CVE-2020-15969) is a use-after-free issue within the usersctp library, and the second (CVE-2020-15683) is described as a buffer overflow vulnerability, which exists due to a boundary error when processing HTML content. If exploited, the both bugs could result in remote code execution.
The WordPress security team has pushed out a forced security update for a popular WordPress plugin called Loginizer intended to address a serious SQL injection issue (CVE-2020-27615) that can lead to complete takeover of the affected application.
The vulnerability exists due to insufficient sanitization of user-supplied data in "loginizer_login_failed" and "lz_valid_ip" functions within the brute force protection functionality. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software contains several vulnerabilities that could allow a remote attacker to bypass authorization checks (CVE-2020-3578), or launch denial-of-service attacks (CVE-2020-3304, CVE-2020-3529, CVE-2020-3528, CVE-2020-3561).