Microsoft releases major security updates for Edge, Teams and Skype – Dainik Savera Times

San Francisco: Tech giant Microsoft has released major security updates for Edge, Teams and Skype to patch two zero-day vulnerabilities in open-source libraries. According to researchers at Google and Citizen Lab, two zero-day vulnerabilities were discovered last month, and both bugs were actively exploited to target individuals with the spyware. The vulnerabilities were discovered in two common open source libraries, WebP and LibVPX.

In a brief statement, Microsoft said it has implemented fixes addressing two vulnerabilities in the WebP and LibVPX libraries. Microsoft is aware and has released patches related to two open source software security vulnerabilities CVE-2023-4863 and CVE-2023-5217, the company said. “Through our investigation we found that these affect a subset of our products and we have addressed them in our products.”

While the CVE-2023-4863 security patch addressed a bug in Skype for Microsoft Teams desktop and WebP Image Extension for Microsoft Edge desktop. CVE-2023-5217 patch released for Microsoft Edge. However, as TechCrunch reports, Microsoft declined to say whether its products were exploited, or whether the company had the ability to know. Last month, Google patched a zero-day vulnerability in Chrome that was exploited by a commercial spyware vendor.

Apple also fixed two zero-day vulnerabilities that were being actively used to distribute Israel-based NSO Group’s Pegasus spyware on iPhones. Internet watchdog group Citizen Lab sued Washington, D.C. The zero-click vulnerability was discovered by a US-based civil society organization while investigating the device of an individual working in its international offices. Citizen Lab immediately disclosed the findings to Apple and assisted in their investigation. Apple released two CVEs related to this trait series, including CVE-2023-41064 and CVE-2023-41061.