Security News > 2020 > July > Zoom Working on Patch for Code Execution Vulnerability in Windows Client
Zoom is working on resolving a remote code execution vulnerability affecting the Windows client, but a third-party fix has been made available for users who don't want to wait for the official patch.
On Thursday, ACROS Security announced the availability of a micro-patch for a remote code execution vulnerability in Zoom Client for Windows.
0patch's security researchers released a micropatch that removes the vulnerability in four different areas of the code, and ported the fix from Zoom Client for Windows 5.1.2 to the previous five versions of the application, back to 5.0.3.
0patch, which published a video showing the vulnerability being exploited in an attack, notes that Windows 10 and Windows 8 machines are not affected.
"Zoom takes all reports of potential security vulnerabilities seriously. Yesterday morning we received a report of an issue impacting users running Windows 7 and older. We have confirmed this issue and are currently working on a patch to quickly resolve it," a Zoom spokesperson said, responding to a SecurityWeek inquiry.
News URL
Related news
- Cleo File Transfer Vulnerability Under Exploitation – Patch Pending, Mitigation Urged (source)
- Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability (source)
- Patch Tuesday: Microsoft Patches One Actively Exploited Vulnerability, Among Others (source)
- BeyondTrust Issues Urgent Patch for Critical Vulnerability in PRA and RS Products (source)
- Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now (source)
- Researchers Uncover Nuclei Vulnerability Enabling Signature Bypass and Code Execution (source)
- Rsync vulnerabilities allow remote code execution on servers, patch quickly! (source)
- Windows Patch Tuesday hits snag with Citrix software, workarounds published (source)
- 7-Zip fixes bug that bypasses Windows MoTW security warnings, patch now (source)
- Don't want your Kubernetes Windows nodes hijacked? Patch this hole now (source)