Mozilla Firefox ESR Security Advisories (MFSA2023-29, MFSA2023-12) - Mac OS X

Mozilla Firefox ESR is prone to heap buffer vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Microsoft Office 2019 Multiple Vulnerabilities (Sep 2023) - Mac OS X

This host is missing an important security update for Microsoft Office 2019 on Mac OS X according to Microsoft security update September 2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Mozilla Firefox < 117.0.1

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 117.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this...

Mozilla Firefox ESR < 115.2.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.2.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of thi...

Mozilla Firefox ESR < 102.15.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 102.15.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of th...

Security Bulletin: Vulnerability in Open JDK affecting Rational Functional Tester

Summary There is vulnerability in Open JDK Version 8, OpenJ9 used by Rational Functional Tester RFT. RFT has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-22049 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attack...

CVE-2023-40442

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8. An app may be able to read sensitive location information...

Security Updates for Microsoft Office Products (Sep 2023) (macOS)

The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the september-12-2023 advisory. - Microsoft Excel Information Disclosure Vulnerability CVE-2023-36766 - Microsoft Word Remote Code Execution Vulnerability CVE-2023-36762 -...

OpenSSL 3.0.0 < 3.0.11 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.0.11. It is, therefore, affected by a vulnerability as referenced in the 3.0.11 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of...

OpenSSL 1.1.1 < 1.1.1w Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1w. It is, therefore, affected by a vulnerability as referenced in the 1.1.1w advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of...

OpenSSL 3.1.0 < 3.1.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.3. It is, therefore, affected by a vulnerability as referenced in the 3.1.3 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applicatio...

A week in security (September 4 - September 10)

Last week on Malwarebytes Labs: Supply chain related security risks, and how to protect against them Password-stealing Chrome extension smuggled on to Web Store Smart chastity device exposes sensitive user data X wants your biometric data Mac users targeted in new malvertising campaign delivering...

Stable Channel Update for Desktop

The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. The Extended Stable channel has been updated to...

CVE-2023-4807

A vulnerability was found in OpenSSL. The security issue occurs in the POLY1305 MAC message authentication code implementation, that contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA...

CVE-2023-4807

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

AZL-39646 CVE-2023-4807 affecting package kata-containers for versions less than 3.2.0.azl1-1

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

AZL-78585 CVE-2023-4807 affecting package openssl-fips-provider 3.1.2-2

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

CVE-2023-4807

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

Design/Logic Flaw

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

CVE-2023-4807 POLY1305 MAC implementation corrupts XMM registers on Windows

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...