Here are the CVE updates for the week of October 6th through 12th.
🔴 Critical Severity Vulnerabilities
Mozilla Multiple Products Remote Code Execution Vulnerability (CISA KEV) | CVE-2010-3765
Description:
A memory corruption vulnerability affects several Mozilla products, including Firefox (3.5.x → 3.5.14, 3.6.x → 3.6.11), Thunderbird (3.0.x before 3.0.10 / 3.1.x before 3.1.6), and SeaMonkey (2.x before 2.0.10). The flaw arises from crafted DOM/frame operations—specifically issues involving nsCSSFrameConstructor::ContentAppended, appendChild, incorrect index tracking, and multiple frame creation. When JavaScript is enabled, specially crafted content can corrupt memory. Moreover, this issue was actively exploited in the wild (Belmoo) in October 2010.
Potential Impacts:
- Remote Code Execution (RCE): Visiting a malicious page or opening crafted content allows arbitrary code execution within the browser or mail client.
- Browser/Application Compromise: Attackers can gain full control of the exploited process, thereby enabling data theft or additional exploitation.
- Denial of Service (DoS): Memory corruption may crash the application, disrupting user activity.
- Data Exposure: Since the browser handles sensitive data, attackers might access sessions, cookies, or stored credentials.
- Privilege Escalation: In chained attacks, adversaries could attempt to escape the browser sandbox and escalate privileges.
Mitigation Recommendations:
- Apply Official Patches Promptly: Update all affected Mozilla products to versions beyond the vulnerable releases.
- Disable JavaScript for Untrusted Sites: Use script-blocking extensions like NoScript, especially when browsing unknown websites.
- Use Supported Versions: Migrate to modern browsers and mail clients that receive ongoing security patches.
- Harden the Execution Environment: Run browsers with least privilege and enable OS-level protections such as ASLR and DEP.
- Implement Network Controls: Deploy web filters, proxy restrictions, and email gateways to detect and block malicious files.
- Enhance Endpoint Detection: Keep antivirus and EDR tools updated to spot exploitation attempts and related behavior.
- Increase User Awareness: Educate users to avoid suspicious links or attachments and restrict the use of legacy systems whenever possible.
Oracle E-Business Suite Unspecified Vulnerability (CISA KEV) | CVE-2025-61882
Description:
A critical network vulnerability exists in the Oracle Concurrent Processing component (BI Publisher Integration) of Oracle E-Business Suite versions 12.2.3 through 12.2.14. An unauthenticated attacker with HTTP access can exploit this flaw to compromise the Concurrent Processing service. Because of its low attack complexity and lack of required privileges, the vulnerability has a CVSS 3.1 base score of 9.8, signifying severe risk to confidentiality, integrity, and availability.
Potential Impacts:
- Complete Service Takeover: Attackers could gain full control of the Concurrent Processing component.
- Confidentiality Loss: Sensitive business data processed by BI Publisher may be stolen.
- Integrity Compromise: Reports and job definitions could be manipulated or replaced.
- Availability Impact: Core batch and reporting services might experience severe disruptions.
- Lateral Movement: Attackers could use this foothold to spread through the E-Business Suite environment or the network.
Mitigation Recommendations:
- Apply Vendor Patches Immediately: Deploy Oracle’s official patch addressing the BI Publisher integration issue.
- Restrict Network Exposure: Limit HTTP access to trusted management networks via IP allowlists or VPN-only connections.
- Deploy Perimeter Controls: Use a web application firewall (WAF) or reverse proxy to block or throttle suspicious traffic.
- Harden Service Accounts: Enforce least privilege principles and rotate service credentials regularly.
- Monitor and Alert: Enable detailed logging and configure SIEM tools to detect anomalies such as unauthorized submissions.
- Isolate and Segment: Keep ERP and management interfaces separated from general-purpose networks with strict ACLs.
- Strengthen Incident Response: Prepare a plan to isolate affected systems, revoke compromised credentials, and rebuild from clean images if necessary.
- Apply Compensating Controls: If patching cannot be done right away, disable vulnerable endpoints and restrict administrative access tightly.
🟠 High Severity Vulnerabilities
Linux Kernel Heap Out-of-Bounds Write Vulnerability (CISA KEV) | CVE-2021-22555: A heap out-of-bounds write flaw exists in the Linux kernel’s Netfilter (x_tables) component, affecting versions since v2.6.19-rc1. Through the user namespace, local attackers can trigger heap corruption, which may lead to privilege escalation to root or cause system crashes. Administrators should patch kernels promptly to maintain system integrity.
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability (CISA KEV) | CVE-2010-3962: Improper handling of certain CSS token sequences and the clip attribute in Internet Explorer 6, 7, and 8 leads to a use-after-free error. Consequently, crafted CSS can allow attackers to control program execution. This issue was exploited in the wild in November 2010.
Microsoft Windows Privilege Escalation Vulnerability (CISA KEV) | CVE-2021-43226: A flaw in the Windows Common Log File System (CLFS) driver enables attackers with local access to execute code with SYSTEM-level privileges. By exploiting improper memory handling, adversaries can escalate privileges without requiring user interaction.
Microsoft Windows Out-of-Bounds Write Vulnerability (CISA KEV) | CVE-2013-3918: This vulnerability affects the InformationCardSigninHelper ActiveX control (icardie.dll). A malicious web page opened in Internet Explorer can trigger out-of-bounds writes, leading to memory corruption. Because this issue was exploited in 2013, immediate patching is essential.
Microsoft Windows Remote Code Execution Vulnerability (CISA KEV) | CVE-2011-3402: A flaw in the TrueType font parsing engine (win32k.sys) allows crafted font data in Word documents or web pages to execute arbitrary code. This vulnerability was leveraged during the Duqu attacks in 2011, making timely patching critical for legacy Windows systems.
Grafana Path Traversal Vulnerability (CISA KEV) | CVE-2021-43798: Grafana versions 8.0.0-beta1 through 8.3.0 contain a path traversal flaw in the plugin asset endpoint (/public/plugins/<plugin-id>/). Attackers can use ../ sequences to access sensitive files on the host. Because authentication isn’t required, administrators should update immediately or restrict access until patched.
🟡 Medium Severity Vulnerabilities
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability (CISA KEV) | CVE-2025-27915: A stored cross-site scripting (XSS) vulnerability impacts Zimbra Collaboration Suite versions 9.0, 10.0, and 10.1 in the Classic Web Client. Malicious HTML/JS inside an ICS calendar entry executes when the victim opens the affected email. This occurs because the system fails to properly sanitize HTML in ICS files. Consequently, attackers can run arbitrary JavaScript in the victim’s session.
Denial of Service via Unbounded RAR Dictionary Size in rardecode (≤ 2.1.1) | CVE-2025-11579: The library rardecode (versions ≤ 2.1.1) does not restrict dictionary size when parsing RAR archives. Attackers can therefore craft large RAR files that consume excessive memory during decompression, leading to an out-of-memory crash. This can cause denial-of-service in applications relying on the vulnerable library.