2021-47 - Canonical, Red Hat, Cisco, Microsoft, Google, GitHub Published on November 29, 2021

Advisory Week

Week 47, 2021

Ubuntu Security Notices

USN-5156-1: ICU vulnerability USN-5155-1: BlueZ vulnerabilities USN-5154-1: FreeRDP vulnerabilities USN-5153-1: LibreOffice vulnerabilities

Red Hat Security Advisory

(RHSA-2021:4839) Important: mailman:2.1 security update (RHSA-2021:4837) Important: mailman:2.1 security update (RHSA-2021:4838) Important: mailman:2.1 security update (RHSA-2021:4826) Important: mailman:2.1 security update (RHSA-2021:4779) Important: kernel-rt security and bug fix update (RHSA-2021:4777) Important: kernel security and bug fix update (RHSA-2021:4798) Important: kpatch-patch security update (RHSA-2021:4774) Important: kernel security update (RHSA-2021:4773) Important: kpatch-patch security update (RHSA-2021:4768) Important: kernel security update (RHSA-2021:4767) Moderate: Red Hat Integration Camel Extensions for Quarkus GA security update (RHSA-2021:4766) Moderate: Release of OpenShift Serverless 1.19.0 (RHSA-2021:4765) Moderate: Release of OpenShift Serverless Client kn 1.19.0

Cisco Security Advisory

Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021

Microsoft Security

Chromium: CVE-2021-38008 Use after free in media Chromium: CVE-2021-38009 Inappropriate implementation in cache Chromium: CVE-2021-38010 Inappropriate implementation in service workers Chromium: CVE-2021-38011 Use after free in storage foundation Chromium: CVE-2021-38012 Type Confusion in V8 Chromium: CVE-2021-38013 Heap buffer overflow in fingerprint recognition Chromium: CVE-2021-38014 Out of bounds write in Swiftshader Chromium: CVE-2021-38015 Inappropriate implementation in input Chromium: CVE-2021-38016 Insufficient policy enforcement in background fetch Chromium: CVE-2021-38017 Insufficient policy enforcement in iframe sandbox Chromium: CVE-2021-38018 Inappropriate implementation in navigation Chromium: CVE-2021-38019 Insufficient policy enforcement in CORS Chromium: CVE-2021-38020 Insufficient policy enforcement in contacts picker Chromium: CVE-2021-38021 Inappropriate implementation in referrer Chromium: CVE-2021-38022 Inappropriate implementation in WebAuthentication Chromium: CVE-2021-38007 Type Confusion in V8 Chromium: CVE-2021-38006 Use after free in storage foundation Chromium: CVE-2021-38005 Use after free in loader Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability Microsoft Edge for iOS Spoofing Vulnerability

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop

Github Security Advisories

[GHSA-2xhg-w2g5-w95x] CSV Injection in symfony/serializer [GHSA-qw36-p97w-vcqr] Cookie persistance after password changes in symfony/security-bundle [GHSA-r64m-qchj-hrjp] Webcache Poisoning in shopware/platform and shopware/core [GHSA-q3j3-w37x-hq2q] Webcache Poisoning in symfony/http-kernel [GHSA-8phj-f9w2-cjcc] Arbitrary file reading vulnerability in Aim [GHSA-3hfw-x7gx-437c] Path traversal in Matrix Synapse