CISA Adds Two Known Vulnerabilities to Catalog

Summary

Recent additions to the Known Exploited Vulnerabilities Catalog published by CISA (Cybersecurity and Infrastructure Security Agency) have introduced two new vulnerabilities that pose significant risks to the federal enterprise. The newly added vulnerabilities are:

1. CVE-2023-41064: An Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow vulnerability, allowing for potential security breaches and exploitation.
2. CVE-2023-41061: An Apple iOS, iPadOS, and watchOS Wallet Code Execution vulnerability, increasing the likelihood of malware attacks and data breaches.

The Known Exploited Vulnerabilities Catalog is a list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise, as mandated by Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. This directive requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats.

While BOD 22-01 primarily applies to FCEB agencies, CISA strongly recommends that all organizations prioritize timely remediation of vulnerabilities as part of their vulnerability management practice to reduce exposure to cyberattacks. CISA will continue to add vulnerabilities to the catalog that meet specified criteria.

In summary, the addition of these two new vulnerabilities emphasizes the importance of vulnerability management practices and adhering to established guidelines to ensure network security and protect against potential threats.