Red Hat Security Advisory 2023-1742-01

Red Hat Security Advisory 2023-1742-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling, buffer overflow, bypass, and denial of service vulnerabilities.

Red Hat Security Advisory 2023-1703-01

Red Hat Security Advisory 2023-1703-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system.

Red Hat Security Advisory 2023-1691-01

Red Hat Security Advisory 2023-1691-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Ubuntu Security Notice USN-6005-1

Ubuntu Security Notice 6005-1 - Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly escaped control characters in log messages and sudoreplay output. An attacker could possibly use these issues to inject terminal control characters that alter output when being viewed.

Apple Security Advisory 2023-04-10-3

Apple Security Advisory 2023-04-10-3 - macOS Big Sur 11.7.6 addresses code execution and out of bounds write vulnerabilities.

Apple Security Advisory 2023-04-10-2

Apple Security Advisory 2023-04-10-2 - macOS Monterey 12.6.5 addresses code execution and out of bounds write vulnerabilities.

Apple Security Advisory 2023-04-10-1

Apple Security Advisory 2023-04-10-1 - iOS 15.7.5 and iPadOS 15.7.5 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-3

Apple Security Advisory 2023-04-07-3 - Safari 16.4.1 addresses code execution and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-1

Apple Security Advisory 2023-04-07-1 - iOS 16.4.1 and iPadOS 16.4.1 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Apple Security Advisory 2023-04-07-2

Apple Security Advisory 2023-04-07-2 - macOS Ventura 13.3.1 addresses code execution, out of bounds write, and use-after-free vulnerabilities.

Red Hat Security Advisory 2023-1646-01

Red Hat Security Advisory 2023-1646-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.11. Issues addressed include a denial of service vulnerability.

APPLE-SA-2023-04-07-3 Safari 16.4.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-3 Safari 16.4.1

Safari 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213722.

WebKit
Available for: macOS Big Sur and macOS Monterey
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: A use after free issue was addressed...

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-1 iOS 16.4.1 and iPadOS 16.4.1

iOS 16.4.1 and iPadOS 16.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213720.

IOSurfaceAccelerator
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air
3rd generation and later, iPad 5th generation and later, and iPad
mini 5th generation and later
Impact: An app may be able to execute arbitrary code...

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-07-2 macOS Ventura 13.3.1

macOS Ventura 13.3.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213721.

IOSurfaceAccelerator
Available for: macOS Ventura
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-3 macOS Big Sur 11.7.6

macOS Big Sur 11.7.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213725.

IOSurfaceAccelerator
Available for: macOS Big Sur
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-1 iOS 15.7.5 and iPadOS 15.7.5

iOS 15.7.5 and iPadOS 15.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213723.

IOSurfaceAccelerator
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone
SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod
touch (7th generation)
Impact: An app may be able to execute arbitrary code with...

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

Posted by Apple Product Security via Fulldisclosure on Apr 10

APPLE-SA-2023-04-10-2 macOS Monterey 12.6.5

macOS Monterey 12.6.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213724.

IOSurfaceAccelerator
Available for: macOS Monterey
Impact: An app may be able to execute arbitrary code with kernel
privileges. Apple is aware of a report that this issue may have been
actively exploited.
Description: An out-of-bounds write issue was...

Debian Security Advisory 5384-1

Debian Linux Security Advisory 5384-1 - Multiple security vulnerabilities have been discovered in OpenImageIO, a library for reading and writing images. Buffer overflows and out-of-bounds read and write programming errors may lead to a denial of service (application crash) or the execution of arbitrary code if a malformed image file is processed.

Ubuntu Security Notice USN-6002-1

Ubuntu Security Notice 6002-1 - It was discovered that Irssi incorrectly handled certain internal routines. An attacker could possibly use this issue to cause a crash.

Red Hat Security Advisory 2023-1549-01

Red Hat Security Advisory 2023-1549-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Issues addressed include privilege escalation and use-after-free vulnerabilities.

Ubuntu Security Notice USN-6003-1

Ubuntu Security Notice 6003-1 - Xi Lu discovered that Emacs did not properly handle certain inputs. An attacker could possibly use this issue to execute arbitrary commands.

Red Hat Security Advisory 2023-1670-01

Red Hat Security Advisory 2023-1670-01 - The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

[dos] Paradox Security Systems IPR512 - Denial Of Service

Paradox Security Systems IPR512 - Denial Of Service

[local] Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing

[webapps] ever gauzy v0.281.9 - JWT weak HMAC secret

ever gauzy v0.281.9 - JWT weak HMAC secret

[webapps] Roxy Fileman 1.4.5 - Arbitrary File Upload

Roxy Fileman 1.4.5 - Arbitrary File Upload

[webapps] Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)

[webapps] BrainyCP V1.0 - Remote Code Execution

BrainyCP V1.0 - Remote Code Execution

[dos] Microsoft Windows 11 - 'cmd.exe' Denial of Service

Microsoft Windows 11 - 'cmd.exe' Denial of Service

[webapps] Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

Online-Pizza-Ordering -1.0 - Remote Code Execution (RCE)

[webapps] Restaurant Management System 1.0 - SQL Injection

Restaurant Management System 1.0 - SQL Injection

[webapps] Suprema BioStar 2 v2.8.16 - SQL Injection

Suprema BioStar 2 v2.8.16 - SQL Injection

[webapps] Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)

[webapps] Adobe Connect 11.4.5 - Local File Disclosure

Adobe Connect 11.4.5 - Local File Disclosure

[remote] Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE)

[webapps] Online Appointment System V1.0 - Cross-Site Scripting (XSS)

Online Appointment System V1.0 - Cross-Site Scripting (XSS)

[webapps] Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)

[webapps] X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)

[local] Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

Stonesoft VPN Client 6.2.0 / 6.8.0 - Local Privilege Escalation

[webapps] WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)

[webapps] Icinga Web 2.10 - Arbitrary File Disclosure

Icinga Web 2.10 - Arbitrary File Disclosure

[local] ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

ESET Service 16.0.26.0 - 'Service ekrn' Unquoted Service Path

[webapps] Medicine Tracker System v1.0 - Sql Injection

Medicine Tracker System v1.0 - Sql Injection

[webapps] dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)

[local] ActFax 10.10 - Unquoted Path Services

ActFax 10.10 - Unquoted Path Services

[dos] FortiRecorder 6.4.3 - Denial of Service

FortiRecorder 6.4.3 - Denial of Service

[webapps] X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)

[local] RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

RSA NetWitness Platform 12.2 - Incorrect Access Control / Code Execution

[webapps] Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)

[webapps] ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)

[local] Lucee Scheduled Job v1.0 - Command Execution

Lucee Scheduled Job v1.0 - Command Execution

[webapps] Altenergy Power Control Software C1.2.5 - OS command injection

Altenergy Power Control Software C1.2.5 - OS command injection

[local] Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

Google Chrome 109.0.5414.74 - Code Execution via missing lib file (Ubuntu)

[remote] pfsenseCE v2.6.0 - Anti-brute force protection bypass

pfsenseCE v2.6.0 - Anti-brute force protection bypass

[webapps] Joomla! v4.2.8 - Unauthenticated information disclosure

Joomla! v4.2.8 - Unauthenticated information disclosure

[webapps] ENTAB ERP 1.0 - Username PII leak

ENTAB ERP 1.0 - Username PII leak

[local] Wondershare Dr Fone 12.9.6 - Privilege Escalation

Wondershare Dr Fone 12.9.6 - Privilege Escalation

[remote] Schneider Electric v1.0 - Directory traversal & Broken Authentication

Schneider Electric v1.0 - Directory traversal & Broken Authentication

[remote] IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)

IBM Aspera Faspex 4.4.1 - YAML deserialization (RCE)