--- title: "Security digest: June 12, 2024" url: https://erroneo.us/security/2024-06-12/ description: "June 12, 2024 vulnerability digest: 2 CISA KEV additions (Arm, PHP Group); 1 critical advisory (Maven, PyPI). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2024-06-12 date_modified: 2024-06-12 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: June 12, 2024 2 known exploited (cisa kev) additions and 1 critical advisory. ## Take stock - Do you run any of these? Arm Mali GPU Kernel Driver, PHP Group PHP. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-07-03. - Maven: 1 critical advisory ( org.apache.submarine:submarine-server-core ). Check with mvn dependency:tree -Dincludes=: . - PyPI: 1 critical advisory ( apache-submarine ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) - [CVE-2024-4610](https://erroneo.us/security/cve/CVE-2024-4610/index.md) Arm Mali GPU Kernel Driver: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability (CISA due 2024-07-03) - [CVE-2024-4577](https://erroneo.us/security/cve/CVE-2024-4577/index.md) PHP Group PHP: PHP-CGI OS Command Injection Vulnerability (CISA due 2024-07-03) ## Critical advisories - [CVE-2024-36265](https://erroneo.us/security/cve/CVE-2024-36265/index.md) Apache Submarine Server Core Incorrect Authorization vulnerability — Maven org.apache.submarine:submarine-server-core = 0.8.0 → no fix; PyPI apache-submarine = 0.8.0 → no fix --- Source page: https://erroneo.us/security/2024-06-12/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt