Cloud computing and virtualization software vendor Citrix has rolled out patches to fix multiple security vulnerabilities, including critical and high-severity issues in its flagship NetScaler product line.
The company said the most severe of these issues is CVE-2024-6235, an improper authorization bug that could allow attackers to access sensitive information.
Citrix also called attention to CVE-2024-6236, a buffer overflow bug in NetScaler Console, Agent, and SVM products that could be exploited to cause a denial-of-service (DoS) condition.
Citrix recommends updating to NetScaler Console and NetScaler Agent versions 14.1-25.53, 13.1-53.22, and 13.0-92.31, and to NetScaler SVM versions 14.1-25.53, 13.1-53.17, and 13.0-92.31.
Patches announced for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) address two high-severity flaws that could be exploited to cause a DoS condition and to redirect users to arbitrary websites.
Citrix resolves both flaws with the release of NetScaler ADC and NetScaler Gateway versions 14.1-25.53, 13.1-53.17, and 13.0-92.31, and NetScaler ADC versions 13.1-FIPS 13.1-37.183, 12.1-FIPS 12.1-55.304, and 12.1-NDcPP 12.1-55.304.
The Texax company also warns that NetScaler ADC and NetScaler Gateway version 12.1, which has been discontinued, is also vulnerable, urging customers to update to a supported version as soon as possible.
Patches were also released for high-severity flaws in the Workspace app for Windows and the Virtual Delivery Agent for Windows used by Citrix Virtual Apps and Desktops and Citrix DaaS, which could lead to elevation of privilege.
A security defect in Citrix Provisioning that could allow a non-admin user to cause short-term disruption in Target VM availability, and flaws in Workspace app for HTML5 leading to GACS Policy Configuration settings bypass and redirection of users to vulnerable URLs were also resolved.
Citrix makes no mention of any of these vulnerabilities being exploited in the wild, but strongly recommends that customers update their appliances as soon as possible. Additional information can be found on the company’s security advisories page.
On Tuesday, the US cybersecurity agency CISA issued an alert on the Citrix patches, warning that “a cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.”
Related: Citrix Warns NetScaler ADC Customers of Zero-Day Exploit
Related: Oracle Patches 230 Vulnerabilities With April 2024 CPU
Related: Microsoft Patches Zero-Click Outlook Vulnerability
Related: Adobe Issues Critical Patches, Warns of Code Execution Risks
