Debian Security Advisory 5536-1

October 27^th 2023 at 12:56

Debian Linux Security Advisory 5536-1 - An important security issue was discovered in Chromium, which could result in the execution of arbitrary code, denial of service or information disclosure.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6145-01

October 27^th 2023 at 12:55

Red Hat Security Advisory 2023-6145-01 - Multicluster Engine for Kubernetes 2.2.9 General Availability release images, which contain security updates and fix bugs. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6105-01

October 27^th 2023 at 12:55

Red Hat Security Advisory 2023-6105-01 - An update is now available for Red Hat JBoss Core Services. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6148-01

October 27^th 2023 at 12:55

Red Hat Security Advisory 2023-6148-01 - Red Hat Advanced Cluster Management for Kubernetes 2.7.9 General Availability release images, which provide security updates and fix bugs. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6143-01

October 27^th 2023 at 12:55

Red Hat Security Advisory 2023-6143-01 - An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.14.

Full Disclosure

[KIS-2023-12] phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability

October 27^th 2023 at 09:45

Posted by Egidio Romano on Oct 27

--------------------------------------------------------------
phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability
--------------------------------------------------------------

[-] Software Link:

https://www.phpfox.com

[-] Affected Versions:

Version 4.8.13 and prior versions.

[-] Vulnerability Description:

User input passed through the "url" request parameter to the
/core/redirect route is not properly sanitized...

Full Disclosure

[KIS-2023-11] SugarCRM <= 13.0.1 (set_note_attachment) Unrestricted File Upload Vulnerability

October 26^th 2023 at 15:25

Posted by Egidio Romano on Oct 26

-------------------------------------------------------------------------------
SugarCRM <= 13.0.1 (set_note_attachment) Unrestricted File Upload
Vulnerability
-------------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 13.0.1 and prior versions.
Version 12.0.3 and prior versions.

[-] Vulnerability Description:

When handling the...

Full Disclosure

[KIS-2023-10] SugarCRM <= 13.0.1 (GetControl) Server-Side Template Injection Vulnerability

October 26^th 2023 at 15:24

Posted by Egidio Romano on Oct 26

----------------------------------------------------------------------------
SugarCRM <= 13.0.1 (GetControl) Server-Side Template Injection
Vulnerability
----------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 13.0.1 and prior versions.
Version 12.0.3 and prior versions.

[-] Vulnerability Description:

There is a sort of Server-Side Template...

Advisory Files ≈ Packet Storm

Ubuntu Security Notice USN-6446-3

October 26^th 2023 at 14:47

Ubuntu Security Notice 6446-3 - Ross Lagerwall discovered that the Xen netback backend driver in the Linux kernel did not properly handle certain unusual packets from a paravirtualized network frontend, leading to a buffer overflow. An attacker in a guest VM could use this to cause a denial of service or possibly execute arbitrary code. Bien Pham discovered that the netfiler subsystem in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local user could use this to cause a denial of service or possibly execute arbitrary code.

Advisory Files ≈ Packet Storm

Ubuntu Security Notice USN-6454-1

October 26^th 2023 at 14:47

Ubuntu Security Notice 6454-1 - Kyle Zeng discovered that the netfilter subsystem in the Linux kernel contained a race condition in IP set operations in certain situations. A local attacker could use this to cause a denial of service. Alex Birnberg discovered that the netfilter subsystem in the Linux kernel did not properly validate register length, leading to an out-of-bounds write vulnerability. A local attacker could possibly use this to cause a denial of service.

Advisory Files ≈ Packet Storm

Gentoo Linux Security Advisory 202310-16

October 26^th 2023 at 14:46

Gentoo Linux Security Advisory 202310-16 - A vulnerability has been discovered in unifi where bundled log4j can facilitate a remote code execution Versions greater than or equal to 6.5.55 are affected.

Advisory Files ≈ Packet Storm

Gentoo Linux Security Advisory 202310-14

October 26^th 2023 at 14:45

Gentoo Linux Security Advisory 202310-14 - A vulnerability has been discovered in libinput where an attacker may run malicious code by exploiting a format string vulnerability. Versions greater than or equal to 1.20.1 are affected.

Advisory Files ≈ Packet Storm

Gentoo Linux Security Advisory 202310-15

October 26^th 2023 at 14:45

Gentoo Linux Security Advisory 202310-15 - A vulnerability has been discovered in usbview where certain users can trigger a privilege escalation. Versions greater than or equal to 2.2 are affected.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-8

October 26^th 2023 at 14:45

Apple Security Advisory 10-25-2023-8 - watchOS 10.1 addresses bypass, code execution, and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-5

October 26^th 2023 at 14:45

Apple Security Advisory 10-25-2023-5 - macOS Ventura 13.6.1 addresses bypass and code execution vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-9

October 26^th 2023 at 14:45

Apple Security Advisory 10-25-2023-9 - Safari 17.1 addresses code execution and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-2

October 26^th 2023 at 14:44

Apple Security Advisory 10-25-2023-2 - iOS 16.7.2 and iPadOS 16.7.2 addresses bypass, code execution, and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-4

October 26^th 2023 at 14:44

Apple Security Advisory 10-25-2023-4 - macOS Sonoma 14.1 addresses bypass, code execution, spoofing, and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-7

October 26^th 2023 at 14:43

Apple Security Advisory 10-25-2023-7 - tvOS 17.1 addresses code execution and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-3

October 26^th 2023 at 14:43

Apple Security Advisory 10-25-2023-3 - iOS 15.8 and iPadOS 15.8 addresses code execution and integer overflow vulnerabilities.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-6

October 26^th 2023 at 14:43

Apple Security Advisory 10-25-2023-6 - macOS Monterey 12.7.1 addresses bypass and code execution vulnerabilities.

Advisory Files ≈ Packet Storm

Debian Security Advisory 5535-1

October 26^th 2023 at 14:42

Debian Linux Security Advisory 5535-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, clickjacking, spoofing or information leaks.

Advisory Files ≈ Packet Storm

Ubuntu Security Notice USN-6452-1

October 26^th 2023 at 14:42

Ubuntu Security Notice 6452-1 - It was discovered that Vim could be made to divide by zero. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.04. It was discovered that Vim did not properly manage memory. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that Vim contained an arithmetic overflow. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 23.04, and Ubuntu 23.10.

Advisory Files ≈ Packet Storm

Apple Security Advisory 10-25-2023-1

October 26^th 2023 at 14:42

Apple Security Advisory 10-25-2023-1 - iOS 17.1 and iPadOS 17.1 addresses bypass, code execution, and use-after-free vulnerabilities.

Advisory Files ≈ Packet Storm

Ubuntu Security Notice USN-6453-1

October 26^th 2023 at 14:40

Ubuntu Security Notice 6453-1 - Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled prepending values to certain properties. An attacker could possibly use this issue to cause the X Server to crash, execute arbitrary code, or escalate privileges. Sri discovered that the X.Org X Server incorrectly handled destroying windows in certain legacy multi-screen setups. An attacker could possibly use this issue to cause the X Server to crash, execute arbitrary code, or escalate privileges.

Advisory Files ≈ Packet Storm

Ubuntu Security Notice USN-6435-2

October 26^th 2023 at 14:35

Ubuntu Security Notice 6435-2 - USN-6435-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 20.04 LTS. It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could possibly use this issue to cause a denial of service.

Advisory Files ≈ Packet Storm

Debian Security Advisory 5534-1

October 26^th 2023 at 14:35

Debian Linux Security Advisory 5534-1 - Jan-Niklas Sohn discovered several vulnerabilities in the Xorg X server, which may result in privilege escalation if the X server is running privileged.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6122-01

October 26^th 2023 at 14:34

Red Hat Security Advisory 2023-6122-01 - Red Hat Advanced Cluster Management for Kubernetes 2.8.3 General Availability release images, which provide security updates and fix bugs. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6137-01

October 26^th 2023 at 14:34

Red Hat Security Advisory 2023-6137-01 - An update for mtr-operator-bundle-container, mtr-operator-container, mtr-web-container, and mtr-web-executor-container is now available for Migration Toolkit for Runtimes 1 on RHEL 8. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6138-01

October 26^th 2023 at 14:34

Red Hat Security Advisory 2023-6138-01 - An update is now available for Migration Toolkit for Runtimes.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6119-01

October 26^th 2023 at 14:33

Red Hat Security Advisory 2023-6119-01 - Multicluster Engine for Kubernetes 2.3.3 General Availability release images, which contain security updates and fix bugs. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6120-01

October 26^th 2023 at 14:33

Red Hat Security Advisory 2023-6120-01 - An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.

Advisory Files ≈ Packet Storm

Red Hat Security Advisory 2023-6121-01

October 26^th 2023 at 14:33

Red Hat Security Advisory 2023-6121-01 - The Migration Toolkit for Containers 1.8.1 is now available.

Full Disclosure

APPLE-SA-10-25-2023-1 iOS 17.1 and iPadOS 17.1

October 25^th 2023 at 20:54