Security News > 2021 > March > Critical Flaw in Jabber for Windows Could Lead to Code Execution
Cisco this week announced the release of software updates that address several vulnerabilities in Jabber for desktop and mobile platforms, the most severe of which could be abused to execute arbitrary code with elevated privileges.
The bugs impact Cisco Jabber for Windows, macOS, and mobile platforms, and are not dependable to one another.
The most important of them is CVE-2021-1411, a critical arbitrary program execution flaw in Jabber for Windows, which exists because of improper validation of message content.
Successful exploitation of this vulnerability could result in code execution, Cisco explains.
Next in line is CVE-2021-1469, a high-severity security hole in Jabber for Windows that, similarly to CVE-2021-1411, could lead to code execution.
Two other medium-severity flaws affect Jabber for Windows, Jabber for macOS, and Jabber for mobile platforms.
News URL
Related news
- Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution (source)
- Proof-of-concept code released for zero-click critical IPv6 Windows hole (source)
- Week in review: SonicWall critical firewalls flaw fixed, APT exploits WPS Office for Windows RCE (source)
- Apache fixes critical OFBiz remote code execution vulnerability (source)
- Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution (source)
- Critical Flaw in Microchip ASF Exposes IoT Devices to Remote Code Execution Risk (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-03-24 | CVE-2021-1411 | Improper Null Termination vulnerability in Cisco Jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. | 9.9 |
| 2021-03-24 | CVE-2021-1469 | Improper Input Validation vulnerability in Cisco Jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. | 7.2 |