APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

macOS Monterey 12.6.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213724.

IOSurfaceAccelerator
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Debian Security Advisory 5384-1

Debian Linux Security Advisory 5384-1 - Multiple security vulnerabilities have been discovered in OpenImageIO, a library for reading and writing images. Buffer overflows and out-of-bounds read and write programming errors may lead to a denial of service (application crash) or the execution of arbitrary code if a malformed image file is processed.

Ubuntu Security Notice USN-6002-1

Ubuntu Security Notice 6002-1 - It was discovered that Irssi incorrectly handled certain internal routines. An attacker could possibly use this issue to cause a crash.

Red Hat Security Advisory 2023-1549-01

Red Hat Security Advisory 2023-1549-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Issues addressed include privilege escalation and use-after-free vulnerabilities.

Ubuntu Security Notice USN-6003-1

Ubuntu Security Notice 6003-1 - Xi Lu discovered that Emacs did not properly handle certain inputs. An attacker could possibly use this issue to execute arbitrary commands.

Red Hat Security Advisory 2023-1670-01

Red Hat Security Advisory 2023-1670-01 - The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

[dos] Paradox Security Systems IPR512 - Denial Of Service

Paradox Security Systems IPR512 - Denial Of Service

[local] Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

[webapps] ever gauzy v0.281.9 - JWT weak HMAC secret

ever gauzy v0.281.9 - JWT weak HMAC secret

[webapps] Roxy Fileman 1.4.5 - Arbitrary File Upload

Roxy Fileman 1.4.5 - Arbitrary File Upload

[webapps] Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

[webapps] BrainyCP V1.0 - Remote Code Execution

BrainyCP V1.0 - Remote Code Execution

[dos] Microsoft Windows 11 - 'cmd.exe' Denial of Service

Microsoft Windows 11 - 'cmd.exe' Denial of Service

[webapps] Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

[webapps] Restaurant Management System 1.0 - SQL Injection

Restaurant Management System 1.0 - SQL Injection

[webapps] Suprema BioStar 2 v2.8.16 - SQL Injection

Suprema BioStar 2 v2.8.16 - SQL Injection

[webapps] Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

[webapps] Adobe Connect 11.4.5 - Local File Disclosure

Adobe Connect 11.4.5 - Local File Disclosure

[remote] Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

[webapps] Online Appointment System V1.0 - Cross-Site Scripting (XSS)

Online Appointment System V1.0 - Cross-Site Scripting (XSS)

[webapps] Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

[webapps] X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

[local] Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

[webapps] WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

[webapps] Icinga Web 2.10 - Arbitrary File Disclosure

Icinga Web 2.10 - Arbitrary File Disclosure

[local] ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

[webapps] Medicine Tracker System v1.0 - Sql Injection

Medicine Tracker System v1.0 - Sql Injection

[webapps] dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

[local] ActFax 10.10 - Unquoted Path Services

ActFax 10.10 - Unquoted Path Services

[dos] FortiRecorder 6.4.3 - Denial of Service

FortiRecorder 6.4.3 - Denial of Service

[webapps] X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

[local] RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

[webapps] Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

[webapps] ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

[local] Lucee Scheduled Job v1.0 - Command Execution

Lucee Scheduled Job v1.0 - Command Execution

[webapps] Altenergy Power Control Software C1.2.5 - OS command injection

Altenergy Power Control Software C1.2.5 - OS command injection

[local] Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

[remote] pfsenseCE v2.6.0 - Anti-brute force protection bypass

pfsenseCE v2.6.0 - Anti-brute force protection bypass

[webapps] Joomla! v4.2.8 - Unauthenticated information disclosure

Joomla! v4.2.8 - Unauthenticated information disclosure

[webapps] ENTAB ERP 1.0 - Username PII leak

ENTAB ERP 1.0 - Username PII leak

[local] Wondershare Dr Fone 12.9.6 - Privilege Escalation

Wondershare Dr Fone 12.9.6 - Privilege Escalation

[remote] Schneider Electric v1.0 - Directory traversal & Broken Authentication

Schneider Electric v1.0 - Directory traversal & Broken Authentication

[remote] IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

[remote] Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

[remote] Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing

Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing

[remote] Franklin Fueling Systems TS-550 - Exploit and Default Password

Franklin Fueling Systems TS-550 - Exploit and Default Password

[webapps] MAC 1200R - Directory Traversal

MAC 1200R - Directory Traversal

[webapps] ChurchCRM 4.5.1 - Authenticated SQL Injection

ChurchCRM 4.5.1 - Authenticated SQL Injection

[webapps] Snitz Forum v1.0 - Blind SQL Injection

Snitz Forum v1.0 - Blind SQL Injection

[webapps] NotrinosERP 0.7 - Authenticated Blind SQL Injection

NotrinosERP 0.7 - Authenticated Blind SQL Injection

[webapps] Rukovoditel 3.3.1 - Remote Code Execution (RCE)

Rukovoditel 3.3.1 - Remote Code Execution (RCE)

Ubuntu Security Notice USN-6000-1

Ubuntu Security Notice 6000-1 - It was discovered that the Upper Level Protocol subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that the NVMe driver in the Linux kernel did not properly handle reset events in some situations. A local attacker could use this to cause a denial of service.

Ubuntu Security Notice USN-6001-1

Ubuntu Security Notice 6001-1 - Xuewei Feng, Chuanpu Fu, Qi Li, Kun Sun, and Ke Xu discovered that the TCP implementation in the Linux kernel did not properly handle IPID assignment. A remote attacker could use this to cause a denial of service or inject forged data. Ke Sun, Alyssa Milburn, Henrique Kawakami, Emma Benoit, Igor Chervatyuk, Lisa Aichele, and Thais Moreira Hamasaki discovered that the Spectre Variant 2 mitigations for AMD processors on Linux were insufficient in some situations. A local attacker could possibly use this to expose sensitive information.

Red Hat Security Advisory 2023-1525-01

Red Hat Security Advisory 2023-1525-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.9.59.

Debian Security Advisory 5383-1

Debian Linux Security Advisory 5383-1 - It was discovered that Ghostscript, the GPL PostScript/PDF interpreter, is prone to a buffer overflow vulnerability in the (T)BCP encoding filters, which could result in the execution of arbitrary code if malformed document files are processed (despite the -dSAFER sandbox being enabled).

Ubuntu Security Notice USN-5998-1

Ubuntu Security Notice 5998-1 - It was discovered that the SocketServer component of Apache Log4j 1.2 incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. It was discovered that the JMSSink component of Apache Log4j 1.2 incorrectly handled deserialization. An attacker could possibly use this issue to execute arbitrary code.

Ubuntu Security Notice USN-5996-1

Ubuntu Security Notice 5996-1 - It was discovered that Liblouis incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.

Red Hat Security Advisory 2023-1666-01

Red Hat Security Advisory 2023-1666-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include a use-after-free vulnerability.

Debian Security Advisory 5382-1

Debian Linux Security Advisory 5382-1 - It was reported that cairosvg, a SVG converter based on Cairo, can send requests to external hosts when processing specially crafted SVG files with external file resource loading. An attacker can take advantage of this flaw to perform a server-side request forgery or denial of service. Fetching of external files is disabled by default with this update.