Cisco Talos Blog: Vulnerability in popular PDF reader could lead to arbitrary code execution; Multiple issues in GNOME project

Source URL: https://blog.talosintelligence.com/vulnerability-roundup-foxit-gnome-oct-9-2024/
Source: Cisco Talos Blog
Title: Vulnerability in popular PDF reader could lead to arbitrary code execution; Multiple issues in GNOME project

Feedly Summary: Talos also discovered three vulnerabilities in Veertu’s Anka Build, a suite of software designed to test macOS or iOS applications in CI/CD environments.

AI Summary and Description: Yes

Summary: The text outlines the recent disclosure by Cisco Talos’ Vulnerability Research team regarding six newly found security vulnerabilities in various software, including a prominent PDF reader and tools for macOS/iOS application testing. These vulnerabilities can lead to significant security risks, including arbitrary code execution and privilege escalation.

Detailed Description: Cisco Talos has reported multiple vulnerabilities that present considerable security risks within widely used applications. The significance of these vulnerabilities for security professionals is the potential for exploitation and the necessity for rapid remediation to mitigate risks.

– **Key Vulnerabilities Highlighted:**
– **Foxit PDF Reader:**
– A use-after-free vulnerability (TALOS-2024-1967, CVE-2024-28888) that allows arbitrary code execution if an adversary can prompt a user to open a malicious PDF.
– Exploitation could occur through either direct interaction with the crafted PDF or via an attacker-controlled website with the browser extension enabled.

– **GNOME Project Library:**
– Two vulnerabilities (TALOS-2024-2068, CVE-2024-36474; TALOS-2024-2069, CVE-2024-42415) in the G Structured File Library that could also lead to arbitrary code execution via malicious files.

– **Veertu Anka Build Software:**
– Three vulnerabilities including:
– Directory traversal vulnerabilities (TALOS-2024-2059, CVE-2024-41163; TALOS-2024-2061, CVE-2024-41922) that could disclose arbitrary files.
– A privilege escalation vulnerability (TALOS-2024-2060, CVE-2024-39755) that allows a low-privileged user to escalate privileges, potentially gaining root access.

– **Remediation Steps:**
– Download the latest rule sets from Snort.org for detection measures against these vulnerabilities.
– Monitor Talos Intelligence’s website for ongoing updates and advisories related to the vulnerabilities.

The detailed findings from Cisco Talos reinforce the importance of continuous monitoring for vulnerabilities across software ecosystems, especially in environments that rely on third-party applications for critical functions. Security and compliance professionals must remain vigilant in implementing updates and patches to mitigate potential exploitations.