The updates fill two gaps. One of these can be used to remotely inject and execute code.

Citrix provides security updates for the virtualization products XenDesktop and XenApps. These remove two loopholes, one of which is (CVE – 2020 – 8270) can be used to smuggle in and execute code remotely (Remote Code Execution, RCE). To do this, however, the affected system must offer Windows file shares that the attacker can access.

The manufacturer provides further information and download links for hotfixes here: CTX 285059: Citrix Virtual Apps and Desktops Security Update.

(ju)