Moderate: Red Hat Security Advisory: libvirt security update

An update for libvirt is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

The vulnerability of the Windows Container Manager service on Windows operating systems allows a hacker to escalate their privileges.

The vulnerability of the Windows Container Manager service in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2023-29546

When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. This bug only affects Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox for Android 112...

DEBIAN-CVE-2023-29541

Firefox did not properly handle downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux...

CVE-2023-28159

The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. This bug only affects Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 111...

The vulnerability in the kernel of operating systems such as MacOS, iOS, tvOS, iPadOS, and watchOS allows attackers to execute arbitrary code and escalate their privileges to root level.

The vulnerability in the kernels of operating systems such as MacOS, iOS, tvOS, iPadOS, and watchOS arises from synchronization errors when using shared resources. Exploiting this vulnerability allows an attacker to execute arbitrary code and increase their privileges to root level...

The vulnerability of the web page rendering module in WebKit operating systems for iOS, iPadOS, watchOS, tvOS, and the Safari browser allows attackers to execute arbitrary code.

The vulnerability of the web page rendering module in WebKit operating systems for iOS, iPadOS, watchOS, tvOS, and the Safari browser is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created web...

The vulnerability of the Metal component in operating systems such as MacOS, iOS, tvOS, iPadOS, and watchOS allows attackers to bypass privacy settings and execute arbitrary code.

The vulnerability of the Metal component in operating systems such as MacOS, iOS, tvOS, iPadOS, and watchOS is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to bypass privacy settings and execute arbitrary code...

The vulnerability of the ksmbd module in Linux operating systems allows a hacker to trigger a service failure.

The vulnerability of the ksmbd module in Linux operating systems is related to the improper release of resources during TCP connection processing. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Xen 安全漏洞

Xen is an open source virtual machine monitor product from the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. Xen has a security vulnerability that stems...

The vulnerability of the Windows Installer component on Windows operating systems, which allows a hacker to increase their privileges

The vulnerability of the Windows Installer component in Windows operating systems is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to increase their privileges...

Microsoft Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows is a set of operating systems used for personal devices.Microsoft Windows Server is a set of server operating systems.Windows Backup Engine is one of the Windows backup engines. An elevation of privilege vulnerability exists in Microsoft Windows Backup Engine. An attacker can...

The vulnerability of the IOSurfaceAccelerator component in iOS, iPadOS, and macOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the IOSurfaceAccelerator component in iOS, iPadOS, and macOS lies in the writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops (formerly XenApp and XenDesktop), operating systems Windows, allows a malicious individual to escalate their privileges and execute arbitrary commands.

The vulnerability of the App-V software service for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiti...

Hunting Russian Intelligence “Snake” Malware

SUMMARY The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service FSB for long-term intelligence collection on sensitive targets. To conduct operations using this tool, the FSB created a covert peer-to-peer P2P...

ALSA-2023:2645 Moderate: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: the functions orderhostkeyalgs and listhostkeytypes leads to double-free vulnerabili...

Moderate: butane security, bug fix, and enhancement update

Butane translates human-readable Butane Configs into machine-readable Ignition configs for provisioning operating systems that use Ignition. The following packages have been upgraded to a later upstream version: butane 0.16.0. BZ2135475 Security Fixes: golang: net/http: handle server errors after...

CVE-2023-27954

The issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4, watchOS 9.4. A website may be able to track sensitive user information...

CVE-2023-27937

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Big Sur 11.7.5, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. Parsing a maliciously crafted plist may lead to an unexpected app termination or arbitrary co...

CVE-2023-27933

The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, macOS Monterey 12.6.4, tvOS 16.4, watchOS 9.4. An app with root privileges may be able to execute arbitrary code with kernel privileges...