Apple Security Advisory 2023-04-10-3

Apple Security Advisory 2023-04-10-3 - macOS Big Sur 11.7.6 addresses code execution and out of bounds write vulnerabilities.

Apple Security Advisory 2023-04-10-2

Apple Security Advisory 2023-04-10-2 - macOS Monterey 12.6.5 addresses code execution and out of bounds write vulnerabilities.

Apple Security Advisory 2023-04-10-1

Apple Security Advisory 2023-04-10-1 - iOS 15.7.5 and iPadOS 15.7.5 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-3

Apple Security Advisory 2023-04-07-3 - Safari 16.4.1 addresses code execution and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-1

Apple Security Advisory 2023-04-07-1 - iOS 16.4.1 and iPadOS 16.4.1 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-2

Apple Security Advisory 2023-04-07-2 - macOS Ventura 13.3.1 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Red Hat Security Advisory 2023-1646-01

Red Hat Security Advisory 2023-1646-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.11. Issues addressed include a denial of service vulnerability.

APPLE-SA-2023-04-07-3 Safari 16.4.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-3 Safari 16.4.1

Safari 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213722.

WebKit
Available for: macOS Big Sur and macOS Monterey
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: A use after free issue was addressed...

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

iOS 16.4.1 and iPadOS 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213720.

IOSurfaceAccelerator
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air
3rd generation and later, iPad 5th generation and later, and iPad
mini 5th generation and later
Impact: An app may be able to execute arbitrary code...

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

macOS Ventura 13.3.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213721.

IOSurfaceAccelerator
Available for: macOS Ventura
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

macOS Big Sur 11.7.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213725.

IOSurfaceAccelerator
Available for: macOS Big Sur
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

iOS 15.7.5 and iPadOS 15.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213723.

IOSurfaceAccelerator
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone
SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod
touch (7th generation)
Impact: An app may be able to execute arbitrary code with...

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

macOS Monterey 12.6.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213724.

IOSurfaceAccelerator
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Debian Security Advisory 5384-1

Debian Linux Security Advisory 5384-1 - Multiple security vulnerabilities have been discovered in OpenImageIO, a library for reading and writing images. Buffer overflows and out-of-bounds read and write programming errors may lead to a denial of service (application crash) or the execution of arbitrary code if a malformed image file is processed.

Ubuntu Security Notice USN-6002-1

Ubuntu Security Notice 6002-1 - It was discovered that Irssi incorrectly handled certain internal routines. An attacker could possibly use this issue to cause a crash.

Red Hat Security Advisory 2023-1549-01

Red Hat Security Advisory 2023-1549-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Issues addressed include privilege escalation and use-after-free vulnerabilities.

Ubuntu Security Notice USN-6003-1

Ubuntu Security Notice 6003-1 - Xi Lu discovered that Emacs did not properly handle certain inputs. An attacker could possibly use this issue to execute arbitrary commands.

Red Hat Security Advisory 2023-1670-01

Red Hat Security Advisory 2023-1670-01 - The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

[dos] Paradox Security Systems IPR512 - Denial Of Service

Paradox Security Systems IPR512 - Denial Of Service

[local] Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

[webapps] ever gauzy v0.281.9 - JWT weak HMAC secret

ever gauzy v0.281.9 - JWT weak HMAC secret

[webapps] Roxy Fileman 1.4.5 - Arbitrary File Upload

Roxy Fileman 1.4.5 - Arbitrary File Upload

[webapps] Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

[webapps] BrainyCP V1.0 - Remote Code Execution

BrainyCP V1.0 - Remote Code Execution

[dos] Microsoft Windows 11 - 'cmd.exe' Denial of Service

Microsoft Windows 11 - 'cmd.exe' Denial of Service

[webapps] Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

[webapps] Restaurant Management System 1.0 - SQL Injection

Restaurant Management System 1.0 - SQL Injection

[webapps] Suprema BioStar 2 v2.8.16 - SQL Injection

Suprema BioStar 2 v2.8.16 - SQL Injection

[webapps] Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

[webapps] Adobe Connect 11.4.5 - Local File Disclosure

Adobe Connect 11.4.5 - Local File Disclosure

[remote] Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

[webapps] Online Appointment System V1.0 - Cross-Site Scripting (XSS)

Online Appointment System V1.0 - Cross-Site Scripting (XSS)

[webapps] Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

[webapps] X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

[local] Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

[webapps] WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

[webapps] Icinga Web 2.10 - Arbitrary File Disclosure

Icinga Web 2.10 - Arbitrary File Disclosure

[local] ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

[webapps] Medicine Tracker System v1.0 - Sql Injection

Medicine Tracker System v1.0 - Sql Injection

[webapps] dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

[local] ActFax 10.10 - Unquoted Path Services

ActFax 10.10 - Unquoted Path Services

[dos] FortiRecorder 6.4.3 - Denial of Service

FortiRecorder 6.4.3 - Denial of Service

[webapps] X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

[local] RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

[webapps] Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

[webapps] ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

[local] Lucee Scheduled Job v1.0 - Command Execution

Lucee Scheduled Job v1.0 - Command Execution

[webapps] Altenergy Power Control Software C1.2.5 - OS command injection

Altenergy Power Control Software C1.2.5 - OS command injection

[local] Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

[remote] pfsenseCE v2.6.0 - Anti-brute force protection bypass

pfsenseCE v2.6.0 - Anti-brute force protection bypass

[webapps] Joomla! v4.2.8 - Unauthenticated information disclosure

Joomla! v4.2.8 - Unauthenticated information disclosure

[webapps] ENTAB ERP 1.0 - Username PII leak

ENTAB ERP 1.0 - Username PII leak

[local] Wondershare Dr Fone 12.9.6 - Privilege Escalation

Wondershare Dr Fone 12.9.6 - Privilege Escalation

[remote] Schneider Electric v1.0 - Directory traversal & Broken Authentication

Schneider Electric v1.0 - Directory traversal & Broken Authentication

[remote] IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

[remote] Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

Docker based datastores for IBM Instana 241-2 243-0 - No Authentication

[remote] Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing

Tenda N300 F3 12.01.01.48 - Malformed HTTP Request Header Processing

[remote] Franklin Fueling Systems TS-550 - Exploit and Default Password

Franklin Fueling Systems TS-550 - Exploit and Default Password

[webapps] MAC 1200R - Directory Traversal

MAC 1200R - Directory Traversal