Vulnerability News - November 11, 2022

Snapshot

Nov. 4, 2022 - Nov. 11, 2022

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2022-41128	Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.	HIGH	Microsoft	Nov. 8, 2022
CVE-2022-41073	Microsoft Windows Print Spooler contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.	HIGH	Microsoft	Nov. 8, 2022
CVE-2022-41125	Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.	HIGH	Microsoft	Nov. 8, 2022
CVE-2022-41091	Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.	MEDIUM	Microsoft	Nov. 8, 2022
CVE-2021-25337	Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.	HIGH	Samsung	Nov. 8, 2022
CVE-2021-25369	Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.	MEDIUM	Samsung	Nov. 8, 2022
CVE-2021-25370	Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.	MEDIUM	Samsung	Nov. 8, 2022
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2022-40304	An issue was discovered in libxml2 before 2.10.3.	N/A		Risk Context N/A
CVE-2022-40303	An issue was discovered in libxml2 before 2.10.3.	HIGH		Risk Context N/A
CVE-2022-41128	Windows Scripting Languages Remote Code Execution Vulnerability.	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2022-41125	Windows CNG Key Isolation Service Elevation of Privilege Vulnerability.	HIGH	Microsoft	CISA Known Exploited
CVE-2022-41091	Windows Mark of the Web Security Feature Bypass Vulnerability.	MEDIUM	Microsoft	CISA Known Exploited
CVE-2022-41073	Windows Print Spooler Elevation of Privilege Vulnerability.	HIGH	Microsoft	CISA Known Exploited
CVE-2022-20465	In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass ...	MEDIUM	Google	Risk Context N/A
CVE-2022-41082	Microsoft Exchange Server Remote Code Execution Vulnerability.	HIGH	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2022-41040	Microsoft Exchange Server Elevation of Privilege Vulnerability.	HIGH	Microsoft	CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

CISA Known Exploited Vulnerabilities

CISA added 7 vulnerabilities to the known exploited vulnerabilities list.

Microsoft — Windows

CVE-2022-41128 / Added: Nov. 8, 2022

HIGH CVSS 8.80

Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.

Headlines

Microsoft — Windows

CVE-2022-41073 / Added: Nov. 8, 2022

HIGH CVSS 7.80

Microsoft Windows Print Spooler contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.

Headlines

Nov. 9, 2022 - Rezilion expands SBOM to support Windows environments

Microsoft — Windows

CVE-2022-41125 / Added: Nov. 8, 2022

HIGH CVSS 7.80

Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.

Headlines

Nov. 8, 2022 - Microsoft Scrambles to Thwart New Zero-Day Attacks

Microsoft — Windows

CVE-2022-41091 / Added: Nov. 8, 2022

MEDIUM CVSS 5.40

Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

Headlines

Nov. 9, 2022 - Microsoft’s November Patch Tuesday Updates Fix 69 Windows Flaws

Samsung — Mobile Devices

CVE-2021-25337 / Added: Nov. 8, 2022

HIGH CVSS 7.10

Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.

Headlines

Nov. 9, 2022 - Surveillance vendor exploited Samsung phone zero-days

Samsung — Mobile Devices

CVE-2021-25369 / Added: Nov. 8, 2022

MEDIUM CVSS 5.50

Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.

Samsung — Mobile Devices

CVE-2021-25370 / Added: Nov. 8, 2022

MEDIUM CVSS 4.40

Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2022-40304

CVSS Not Assigned

Risk Context N/A

Published: Nov. 23, 2022

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Quotes

When an entity reference cycle is detected, the entity content is cleared by setting its first byte to zero. But the entity content might be allocated from a dict. In this case, the dict entry becomes corrupted leading to all kinds of logic errors, including memory errors like double-frees - Security Affairs
A remote user may be able to cause unexpected app termination or arbitrary code execution - Naked Security - Sophos
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available - Latest news
I've not seen evidence of exploitation of the issues fixed in iOS 16.1.1-but that doesn't really mean much - Forbes - Cybersecurity

Headlines

CVE-2022-40303

HIGH CVSS 7.50

Risk Context N/A

Published: Nov. 23, 2022

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Quotes

When an entity reference cycle is detected, the entity content is cleared by setting its first byte to zero. But the entity content might be allocated from a dict. In this case, the dict entry becomes corrupted leading to all kinds of logic errors, including memory errors like double-frees - Security Affairs
A remote user may be able to cause unexpected app termination or arbitrary code execution - Naked Security - Sophos
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available - Latest news
I've not seen evidence of exploitation of the issues fixed in iOS 16.1.1-but that doesn't really mean much - Forbes - Cybersecurity

Headlines

CVE-2022-41128

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Nov. 9, 2022

Windows Scripting Languages Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-41118.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2012, Windows 7, Windows Server 2022, Windows 8.1, Windows, Windows Server 2019, Windows Server 2016, Windows 11, Windows 10, Windows Server 2008

Quotes

Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
The big news is that two older zero-day CVEs affecting Exchange Server, made public at the end of September, have finally been fixed - The Hacker News
Windows Mark of the Web - Krebs on Security
More likely to be exploited - The Register - Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

CVE-2022-41125

HIGH CVSS 7.80

CISA Known Exploited

Published: Nov. 9, 2022

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2012, Windows 7, Windows Server 2022, Windows 8.1, Windows, Windows Server 2019, Windows Server 2016, Windows 11, Windows 10

Quotes

Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
Windows Mark of the Web - Krebs on Security
More likely to be exploited - The Register - Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

CVE-2022-41091

MEDIUM CVSS 5.40

CISA Known Exploited

Published: Nov. 9, 2022

Windows Mark of the Web Security Feature Bypass Vulnerability. This CVE ID is unique from CVE-2022-41049.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2022, Windows, Windows Server 2019, Windows Server 2016, Windows 11, Windows 10

Quotes

An attacker can craft a malicious file that would evade MotW defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MotW tagging - SecurityWeek
Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
The big news is that two older zero-day CVEs affecting Exchange Server, made public at the end of September, have finally been fixed - The Hacker News
Windows Mark of the Web - Krebs on Security
More likely to be exploited - The Register - Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

CVE-2022-41073

HIGH CVSS 7.80

CISA Known Exploited

Published: Nov. 9, 2022

Windows Print Spooler Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Products Impacted: Windows Server 2012, Windows 7, Windows Server 2022, Windows 8.1, Windows, Windows Server 2019, Windows Server 2016, Windows 11, Windows 10, Windows Server 2008

Quotes

Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
Windows Mark of the Web - Krebs on Security
More likely to be exploited - The Register - Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

CVE-2022-20465

MEDIUM CVSS 4.60

Risk Context N/A

Published: Nov. 8, 2022

In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-218500036

Vendor Impacted: Google

Product Impacted: Android

Quotes

Unlockable but only with a passcode - Naked Security - Sophos
Dismiss and related functions of KeyguardHostViewController.java and related files - SecurityWeek
The issue allowed an attacker with physical access to bypass the lock screen protections (fingerprint, PIN, etc.) and gain complete access to the user's device. The vulnerability is tracked asÂ CVE-2022-20465Â and itÂ mightÂ affect other Android vendors as well - Security Affairs
After I calmed down a little bit, I realized that indeed, this is a got d*mn full lock screen bypass, on the fully patched Pixel 6. I got my old Pixel 5 and tried to reproduce the bug there as well. It worked too - Dark Reading
It was a fresh boot, and instead of the usual lock icon, the fingerprint icon was showing - The Daily Swig | Cybersecurity news and views
The issue allowed an attacker with physical access to bypass the lock screen protections (fingerprint, PIN, etc.) and gain complete access to the user's device - The Hacker News

Headlines

CVE-2022-41082

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Remote Code Execution Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

Walk around, are they tight? Do they pinch? - Naked Security - Sophos
We were only trying to help - Naked Security - Sophos
They were expected last month, but they are finally here (along with several other Exchange fixes). These bugs were purchased by the ZDI at the beginning of September and reported to Microsoft at the time. At some point later, they were detected in the wild. Microsoft has released several different mitigation recommendations, but the best advice is to test and deploy these fixes - Security Affairs
Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
It took Microsoft more than two months to provide the patch, even though the company admitted that ProxyNotShell actively exploited the vulnerabilities in targeted attacks against at least 10 large organizations - Forbes - Cybersecurity
Windows Mark of the Web - Krebs on Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

CVE-2022-41040

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Used In Ransomware Public Exploits Available

Published: Oct. 3, 2022

Microsoft Exchange Server Elevation of Privilege Vulnerability.

Vendor Impacted: Microsoft

Product Impacted: Exchange Server

Quotes

We were only trying to help - Naked Security - Sophos
They were expected last month, but they are finally here (along with several other Exchange fixes). These bugs were purchased by the ZDI at the beginning of September and reported to Microsoft at the time. At some point later, they were detected in the wild. Microsoft has released several different mitigation recommendations, but the best advice is to test and deploy these fixes - Security Affairs
Considering it's a browse-and-own type of scenario, I expect this will be a popular bug to include in exploit kits - Latest news
A Dynamic SBOM that supports Windows environments widens the scope of possibility and gives the ability to a massive number of new customers to meet regulatory standards and detect and manage their software vulnerabilities strategically - CSO Online
We recommend applying patches within 24 hours if you have vulnerable on-prem or hybrid exchange servers where temporary mitigation has not been applied - infosecurity-magazine.com
It took Microsoft more than two months to provide the patch, even though the company admitted that ProxyNotShell actively exploited the vulnerabilities in targeted attacks against at least 10 large organizations - Forbes - Cybersecurity
Windows Mark of the Web - Krebs on Security
More likely to be exploited - The Register - Security
At long last, Microsoft released patches for the ProxyNotShell vulnerabilities that are being actively exploited by Chinese threat actors - Dark Reading

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

November 11, 2022

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

November 11, 2022

Snapshot

CISA Known Exploited Vulnerabilities

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Microsoft — Windows

Microsoft — Windows

Microsoft — Windows

Microsoft — Windows

Samsung — Mobile Devices

Samsung — Mobile Devices

Samsung — Mobile Devices

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe