Security News > 2022 > February > CISA tells agencies to patch actively exploited Chrome, Magento bugs
The US Cybersecurity and Infrastructure Security Agency has added nine new flaws to its collection of actively exploited vulnerabilities, including two recently patched zero-days impacting Google Chrome and Adobe Commerce/Magento Open Source.
The Chrome vulnerability is a high severity use after free bug that can let attackers execute arbitrary code or escape the browser's security sandbox on computers running unpatched Chrome versions addressed in Chrome 98.0.4758.102.
CISA said that all Federal Civilian Executive Branch Agencies agencies must deploy patches for these two security vulnerabilities until March 1st, 2022.
Federal agencies are required to patch their systems against these actively exploited vulnerabilities, according to a binding operational directive issued by CISA in November 2021.
Last week, the US cybersecurity agency also told agencies to update iPhones, Macs, and iPads until February 25th against an Apple WebKit remote code execution bug exploited in the wild.
One day earlier, CISA also asked fed agencies to patch 15 other actively exploited flaws, with CVE-2021-36934 - a Microsoft Windows SAM vulnerability allowing privilege escalation and credential theft - having a February 24th patch deadline.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-07-22 | CVE-2021-36934 | Unspecified vulnerability in Microsoft products <p>An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. | 7.8 |