CLSA-2023-1703610859 Fix CVE(s): CVE-2023-51385

SECURITY UPDATE: possible OS command injection - debian/patches/CVE-2023-51385.patch: ban user/hostnames with most shell metacharacters in command line - CVE-2023-51385...

The vulnerability of the ImageIO component in operating systems such as macOS, iOS, iPadOS, tvOS, and watchOS allows attackers to execute arbitrary code.

The vulnerability of the ImageIO component in operating systems such as macOS, iOS, iPadOS, tvOS, and watchOS relates to the execution of operations outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2023-6857

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

CVE-2023-6857

When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and...

CVE-2023-6857

When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and...

IBM i License Issues Vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. An authorization issue vulnerability exists in IBM i Access Client Solutions that stems from improper privilege checking and can be exploited by an attacker to execute...

The vulnerability of the DHCP server service for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the DHCP server service for Windows operating systems is related to insufficient protection of service-related data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the MSHTML platform in Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the MSHTML platform in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted email...

CVE-2023-42883

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. Processing an image may lead to a denial-of-service...

CVE-2023-42884

This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. An app may be able to disclose kernel memory...

PT-2023-9072 · Qnap · Quts Hero +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.0.1.2514 build 20230906 QTS versions prior to 5.1.2.2533 build 20230926 QuTS hero h versions prior to h5.0.1.2515 build 20230907 QuTS hero h versions prior to h5.1.2.2534 build 20230927 Description: A buffer copy witho...

PT-2023-8165 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to 5.1.3.2578 build 20231110 Description: A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited,...

The vulnerability of operating systems such as iOS, iPadOS, macOS, and the browser Safari, related to lack of access control, allows attackers to disclose protected information.

The vulnerability of the Web page rendering module in WebKit operating systems for iOS, iPadOS, macOS, and the Safari browser is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to disclose protected information processed from web content...

The vulnerability of the cloud-based personal assistant Siri in operating systems such as macOS, watchOS, iOS, and iPadOS allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the cloud-based personal assistant Siri in operating systems such as macOS, watchOS, iOS, and iPadOS is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the NTFS file system in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the NTFS file system in Windows operating systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Windows Authentication component in Windows operating systems allows a hacker to trigger a service failure.

The vulnerability of the Windows Authentication component in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2023-48295

LibreNMS CVE-2023-48295 is an XSS vulnerability in device group popups caused by unsanitized device group names in DeviceGroupController.php (L173). Affected: LibreNMS with vulnerable device-group handling prior to 23.11.0. The issue has been fixed in commit faf66035ea and included in release 23....

The vulnerability of the Hyper-V hardware virtualization system for Windows operating systems allows attackers to escalate their privileges.

The vulnerability of the Hyper-V hardware virtualization technology for Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges by sending specially crafted requests...

Oracle Linux 9 : cups (ELSA-2023-6596)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6596 advisory. - CVE-2023-32360 cups: Information leak through Cups-Get-Document operation - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient in...

Huawei EulerOS: Security Advisory for cups-filters (EulerOS-SA-2023-3120)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...