Microsoft (& Apple) Patch Tuesday, April 2023 Edition

Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day...

Vulnerabilities fixed in Fortinet FortiSandbox

Fortinet has fixed vulnerabilities in FortiSandbox. A authenticated malicious person could exploit the vulnerabilities to execute arbitrary code, or to gain access to sensitive data from within the underlying system. Fortinet has released updates to fix the vulnerabilities in FortiSandbox. For mo...

Security Updates for Microsoft Office Products (Apr 2023) (macOS)

The Microsoft Office product installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Microsoft Office Remote Code Execution Vulnerability. CVE-2023-28285 - Microsoft Word Remote Code Execution Vulnerability. CVE-2023-28311 Note that Ness...

Security Updates for Windows Defender (April 2023)

The Malware Protection Engine version of Microsoft Windows Defender installed on the remote Windows host is prior to 1.1.20200.4. It is, therefore, affected by a denial of service vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Sudo vulnerabilities (USN-6005-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6005-1 advisory. Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly escaped control characters in log messages and sudoreplay...

Security Updates for Microsoft Dynamics 365 (on-premises) (April 2023)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple session spoofing vulnerabilities. An attacker can exploit these to perform actions with the privileges of another user. Note that Nessus has not tested for these issues but has instead relie...

Security Updates for Microsoft Visual Studio Products (April 2023)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - .NET DLL Hijacking Remote Code Execution Vulnerability. CVE-2023-28260 - Visual Studio Elevation of Privilege Vulnerability. CVE-2023-28262 - Visual Studio Information...

Apple Releases Security Updates for Multiple Products

Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device. CISA encourages users and administrators to review the following advisories and apply the necessary updates. iOS 15.7...

April 11, 2023—KB5025287 (Monthly Rollup)

None None...

April 11, 2023—KB5025279 (Monthly Rollup)

None None...

April 11, 2023—KB5025285 (Monthly Rollup)

None None...

April 11, 2023—KB5025277 (Security-only update)

None None...

April 11, 2023—KB5025273 (Security-only update)

None None...

April 11, 2023—KB5025272 (Security-only update)

None None...

April 11, 2023—KB5025271 (Monthly Rollup)

None None...

April 11, 2023—KB5025221 (OS Builds 19042.2846, 19044.2846, and 19045.2846) - EXPIRED

None None...

KB5021123 - Description of the security update for SQL Server 2012 SP4 GDR: February 14, 2023

None None...

January 10, 2023—KB5022348 (Monthly Rollup)

None None...

PT-2023-2527 · Fortinet · Fortinac

Name of the Vulnerable Software and Affected Versions: FortiNAC versions 9.4.1 and below FortiNAC versions 9.2.6 and below FortiNAC versions 9.1.8 and below FortiNAC versions 8.8.11 and below FortiNAC versions 8.7.6 and below Description: The issue is related to an exposure of sensitive informati...

KLA48823 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute...