Recently, numerous serious security vulnerabilities have been discovered in widely used programs. These pose a massive threat to PC security. We show you how you can close them.
The BSI report on the state of IT security in Germany presents alarming figures: In 2023, the Federal Office for Information Security registered an average of 68 new vulnerabilities in software products every day, resulting in almost 25,000 new vulnerabilities per year.
Security-related errors were counted in programs of all kinds, from specialist applications for industry to server software for companies and smartphone apps.
Most of these vulnerabilities, around 47 percent, enabled the execution of unauthorized commands or program code. In this way, the attackers could, for example, install ransomware on a computer, bypass security measures, extend their own access rights, or read out data in order to sell it to other groups or blackmail the owners.
Winrar executes embedded scripts and loads malicious code
IDG
In August 2023, a security vulnerability was discovered in the popular Winrar packing program that allowed criminal hackers to execute scripts on the user’s computer. The cause was an error in the tool’s handling of file name extensions.
On this basis, it was possible to prepare RAR archives in such a way that a script was automatically started when a file was opened and, for example, additional files were downloaded from the internet.
In August, Win.rar GmbH released the revised version 6.23, which fixed the error. Version 6.24 is now available. However, it is likely that many users are still working with an earlier, vulnerable version of the program.
Another major problem is that many other manufacturers have licensed Winrar’s compression mechanism and incorporated it into their own products. One example is the Total Commander file manager. Therefore, if a program offers to open and create RAR archives, you should definitely update it to the latest version.
False and real errors in VLC Media Player
IDG
The open source software VLC Media Player has been attracting media attention for several years now, as security vulnerabilities have been discovered time and again. However, some of these were false reports, such as a news item from 2019.
The error only affected the Linux version of the VLC player and, according to the VLC developers, the cause was not in their software but in a faulty program library in some Linux distributions.
However, it has been confirmed that some VLC downloads from unofficial sites contain a foreign DLL file that is loaded when the tool is called up and subsequently enables access to the computer from outside. The lesson learned: Only ever download software from the manufacturer’s website or from trustworthy sites.
In 2022, however, a number of critical security vulnerabilities in VLC Player also became known. These made it possible for an attacker to cause the tool to crash via a prepared file, for example, and retrieve malicious code from external sources or trigger a denial of service, i.e. paralyze the computer. All the user had to do was play a video file or open a playlist.
The manufacturer Videolan fixed the problems with version 3.0.18; the current version is 3.0.20.
Images in the graphic format Webp bring malicious code with them
IDG
Last September, Google registered a vulnerability in its Chrome browser that allowed attackers to trigger a buffer overflow and execute malicious code. The widely used graphic format Webp, which is characterized by particularly small file sizes, was affected.
Trending for you
- Best laptops 2024: Premium laptops, budget laptops, 2-in-1s, and more
- Best VPN services 2024: Top picks for speed, price, privacy, and more
- Best Thunderbolt docks 2024: Extend your laptop’s capabilities
All a user had to do was open a crafted image in this format and the code was executed on their computer. With Google Chrome, it was sufficient to open a website with a Webp image.
Just a few hours later, the company corrected itself and explained that a number of other applications besides Chrome were vulnerable. In fact, the bug was not in the browser itself, but in the open library libwebp, which the program accesses when opening webp images. This library is also used by numerous other programs, including Chrome, Firefox, and Edge as well as applications such as Gimp, Inkscape, Libreoffice, Signal, Thunderbird, and 1Password.
While patches have long been available for browsers, which are also installed automatically, many programs on users’ PCs are probably still running in outdated, unpatched versions. You should therefore immediately update any software that can read Webp graphics to the latest version number.
How to protect yourself from vulnerabilities in programs
Recently, numerous serious security vulnerabilities have been discovered in widely used programs. These pose a massive threat to PC security. We will show you which vulnerabilities are involved and how you can close them.
- Install available patches and new software versions immediately. Use a tool such as the free Ucheck to regularly check for new releases.
- Use a password manager such as Dashlane or Bitwarden. Define a different password for each service, shop, account, etc. and choose long and complex character combinations.
- Wherever possible, you should use two-factor authentication.
- Regularly back up your most important data to an external medium, which you then disconnect from your computer.
- Be aware of the dangers of phishing mails. Check the sender’s address and the links contained in messages from banks, streaming providers and delivery services in particular.
Memory errors in Foxit PDF Reader allow malicious code to run
IDG
In November 2023, several vulnerabilities were discovered in Foxit PDF Reader and Foxit PDF Editor that could lead to memory errors when opening manipulated document files. It was then possible for an attacker to execute arbitrary malicious code on the computer.
The manufacturer has now released version 2023.3, which closes these vulnerabilities.
