<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SonicOS, ImageMagick\u00a0and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> SonicWall SonicOS, ImageMagick\u00a0and Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/gwmw><\/p>\n\n\n\n

Below are the descriptions for these vulnerabilities:<\/gwmw><\/gwmw><\/p>\n\n\n\n

\n
• CVE-2016-3714<\/a>\u00a0ImageMagick Improper Input Validation Vulnerability<\/li>\n\n\n\n
• CVE-2017-1000253<\/a>\u00a0Linux Kernel PIE Stack Buffer Corruption Vulnerability<\/li>\n\n\n\n
• CVE-2024-40766\u00a0<\/a> SonicWall SonicOS Improper Access Control Vulnerability<\/li>\n<\/ul>\n\n\n\n

  CVE-2016-3714<\/a> flaw (aka ImageTragick), in the popular image manipulation software ImageMagick<\/a> could allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka “ImageTragick.” Attackers can exploit the flaw to take over\u00a0websites running the widely used image-enhancing app. The vulnerability in ImageMagick App allows attackers to run arbitrary code on the targeted web servers that rely on the app for resizing or cropping user-uploaded images.<\/gwmw><\/p>\n\n\n\n

  CVE-2017-1000253<\/a> flaw was discovered by researchers with Qualys Research Labs and affects all Linux distributions that have not fixed their kernels after a commit\u00a0released<\/a>\u00a0on April 14, 2015. Attackers can exploit the vulnerability to escalate privileges. The issue resides in the way the kernel loads ELF executables and is triggered by applications that have been built as Position Independent Executables (PIEs). <\/p>\n\n\n\n

  \u201cA flaw was found in the way the Linux kernel loaded ELF executables. Provided that an application was built as Position Independent Executable (PIE), the loader could allow part of that application\u2019s data segment to map over the memory area reserved for its stack, potentially resulting in memory corruption.\u201d reads the\u00a0advisory<\/a><\/strong>\u00a0published on RedHat. \u201cAn unprivileged local user with access to SUID (or otherwise privileged) PIE binary could use this flaw to escalate their privileges on the system.\u201d<\/em><\/p>\n\n\n\n

  CVE-2024-40766\u00a0<\/a> is an Improper Access Control Vulnerability impacting SonicWall SonicOS. SonicWall warns that a recently fixed access control flaw, tracked as CVE-2024-40766 (CVSS v3 score: 9.3), in SonicOS is now potentially exploited in attacks.<\/p>\n\n\n\n

  <\/gwmw>According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

  CISA orders federal agencies to fix this vulnerability by\u00a0September 30, 2024.<\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0CISA<\/a>)<\/strong><\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall SonicOS, ImageMagick\u00a0and Linux Kernel bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added SonicWall SonicOS, ImageMagick\u00a0and Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these vulnerabilities: CVE-2016-3714 flaw (aka ImageTragick), in the popular […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,55],"tags":[8913,4112,9508,5140,9506,10918,12584,2197,687,841,1533,8635],"class_list":["post-168251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-security","tag-cisa","tag-hacking","tag-hacking-news","tag-imagemagick","tag-information-security-news","tag-it-information-security","tag-known-exploited-vulnerabilities-catalog","tag-linux-kernel","tag-pierluigi-paganini","tag-security-affairs","tag-security-news","tag-sonicwall"],"yoast_head":"\n