2021-44 - Mozilla, Canonical, Red Hat, Cisco, Google, Jenkins, GitHub Published on November 8, 2021

Advisory Week

Week 44, 2021

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 91.3 mfsa2021-50 Security Vulnerabilities fixed in Firefox ESR 91.3 mfsa2021-49 Security Vulnerabilities fixed in Firefox 94 mfsa2021-48

Ubuntu Security Notices

USN-5133-1: ICU vulnerability USN-5132-1: Thunderbird vulnerabilities USN-5131-1: Firefox vulnerabilities USN-5128-1: Ceph vulnerabilities USN-5127-1: WebKitGTK vulnerabilities USN-5121-2: Mailman vulnerabilities

Red Hat Security Advisory

(RHSA-2021:4134) Important: thunderbird security update (RHSA-2021:4132) Important: thunderbird security update (RHSA-2021:4130) Important: thunderbird security update (RHSA-2021:4133) Important: thunderbird security update (RHSA-2021:4008) Moderate: OpenShift Container Platform 4.6.49 security update (RHSA-2021:4123) Important: firefox security update (RHSA-2021:4122) Important: kpatch-patch security update (RHSA-2021:4116) Important: firefox security update (RHSA-2021:4112) Moderate: virt:av and virt-devel:av security and bug fix update (RHSA-2021:4107) Important: flatpak security update (RHSA-2021:4106) Important: flatpak security update (RHSA-2021:4103) Moderate: OpenShift Virtualization 4.9.0 RPMs security and bug fix update (RHSA-2021:4104) Moderate: OpenShift Virtualization 4.9.0 Images security and bug fix update (RHSA-2021:4100) Moderate: Red Hat Integration - Service Registry release and security update [2.0.2.GA] (RHSA-2021:4097) Moderate: webkit2gtk3 security and bug fix update (RHSA-2021:4089) Moderate: java-1.8.0-ibm security update (RHSA-2021:4088) Important: kernel-rt security and bug fix update (RHSA-2021:4058) Moderate: samba security update (RHSA-2021:4057) Moderate: python3 security update (RHSA-2021:4060) Moderate: libsolv security update (RHSA-2021:4059) Moderate: curl security update (RHSA-2021:4056) Important: kernel security, bug fix, and enhancement update (RHSA-2021:4044) Important: flatpak security update (RHSA-2021:4042) Important: flatpak security update (RHSA-2021:4039) Moderate: devtoolset-10-gcc security update (RHSA-2021:4033) Moderate: binutils security update (RHSA-2021:4034) Moderate: binutils security update (RHSA-2021:4035) Moderate: binutils security update (RHSA-2021:4036) Moderate: binutils security update (RHSA-2021:4037) Moderate: binutils security update (RHSA-2021:4038) Moderate: binutils security update

Cisco Security Advisory

Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Privilege Escalation Vulnerability Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities Cisco Prime Access Registrar Stored Cross-Site Scripting Vulnerability Cisco Policy Suite Static SSH Keys Vulnerability Cisco Common Services Platform Collector Information Disclosure Vulnerability Cisco Unified Communications Products Path Traversal Vulnerability Cisco Email Security Appliance Denial of Service Vulnerability Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting Vulnerability Cisco Small Business RV Series Routers Command Injection Vulnerability Cisco Small Business Series Switches Session Credentials Replay Vulnerability Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service Vulnerability Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability Cisco Umbrella Email Enumeration Vulnerability Cisco Webex Video Mesh Cross-Site Scripting Vulnerability Cisco Webex Video Mesh Arbitrary Site Redirection Vulnerability Cisco Webex Meetings Email Content Injection Vulnerability

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop Chrome Releases: Stable Channel Update for Desktop

Jenkins Security Advisories

Jenkins Security Advisory 2021-11-04

Github Security Advisories

[GHSA-hgc3-hp6x-wpgx] Antilles Dependency Confusion Vulnerability [GHSA-v935-pqmr-g8v9] Unexpected panics in num-bigint [GHSA-93c4-vf86-3rj7] Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 [GHSA-7rq6-7gv8-c37h] Missing Authorization with Default Settings in Dashboard UI [GHSA-r8hm-w5f7-wj39] Cross-site scripting vulnerability in TinyMCE plugins [GHSA-cf2j-vf36-c6w8] Communities and collections administrators can escalate their privilege up to system administrator [GHSA-hwhf-64mh-r662] ReDoS vulnerability in parser_apache2 [GHSA-f5f7-6478-qm6p] Files or Directories Accessible to External Parties in kubernetes