2022-11 - Apple, Canonical, Red Hat, nodejs, Microsoft, Amazon, GitHub Published on March 21, 2022

Advisory Week

Week 11, 2022

Apple Security Advisory

Safari 15.4 Security Content iOS 15.4 and iPadOS 15.4 Security Content watchOS 8.5 Security Content tvOS 15.4 Security Content macOS Monterey 12.3 Security Content macOS Big Sur 11.6.5 Security Content Security Update 2022-003 Catalina Security Content Xcode 13.3 Security Content Logic Pro X 10.7.3 Security Content GarageBand 10.4.6 Security Content

Ubuntu Security Notices

USN-5335-1: ImageMagick vulnerabilities USN-5333-2: Apache HTTP Server vulnerabilities USN-5332-2: Bind vulnerability USN-5321-2: Firefox vulnerabilities USN-5334-1: man-db vulnerability USN-5333-1: Apache HTTP Server vulnerabilities USN-5332-1: Bind vulnerabilities USN-5331-1: tcpdump vulnerabilities USN-5328-2: OpenSSL vulnerability USN-5330-1: LibreOffice vulnerability USN-5329-1: tar vulnerability USN-5328-1: OpenSSL vulnerability USN-5327-1: rsh vulnerability USN-5325-1: Zsh vulnerabilities USN-5324-1: libxml2 vulnerability USN-5323-1: NBD vulnerabilities

Red Hat Security Advisory

(RHSA-2022:0958) Important: kpatch-patch-4_18_0-147_58_1 security and bug fix update (RHSA-2022:0951) Important: expat security update (RHSA-2022:0952) Moderate: redhat-ds:11.3 security and bug fix update (RHSA-2022:0949) Moderate: virt:av and virt-devel:av security and bug fix update (RHSA-2022:0947) Moderate: OpenShift Virtualization 4.10.0 Images security and bug fix update (RHSA-2022:0810) Important: OpenShift Container Platform 4.10.4 security update (RHSA-2022:0925) Important: kpatch-patch security update (RHSA-2022:0886) Moderate: virt:rhel and virt-devel:rhel security update (RHSA-2022:0891) Moderate: httpd:2.4 security update (RHSA-2022:0889) Low: 389-ds:1.4 security and bug fix update (RHSA-2022:0896) Moderate: glibc security update (RHSA-2022:0856) Moderate: Red Hat Advanced Cluster Management 2.2.11 security updates and bug fixes (RHSA-2022:0855) Moderate: OpenShift sandboxed containers 1.2.0 security update (RHSA-2022:0853) Important: thunderbird security update (RHSA-2022:0850) Important: thunderbird security update (RHSA-2022:0851) Important: kpatch-patch security update (RHSA-2022:0845) Important: thunderbird security update (RHSA-2022:0847) Important: thunderbird security update (RHSA-2022:0849) Important: kpatch-patch security update (RHSA-2022:0843) Important: thunderbird security update (RHSA-2022:0842) Important: Release of containers for OSP 16.2 director operator tech preview (RHSA-2022:0841) Important: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.10] Async #1

Node.js Security Advisories

OpenSSL security releases may require Node.js security releases

Microsoft Security

Chromium: CVE-2022-0972 Use after free in Extensions Chromium: CVE-2022-0974 Use after free in Splitscreen Chromium: CVE-2022-0973 Use after free in Safe Browsing Chromium: CVE-2022-0975 Use after free in ANGLE Chromium: CVE-2022-0980 Use after free in New Tab Page Chromium: CVE-2022-0979 Use after free in Safe Browsing Chromium: CVE-2022-0978 Use after free in ANGLE Chromium: CVE-2022-0977 Use after free in Browser UI Chromium: CVE-2022-0976 Heap buffer overflow in GPU Chromium: CVE-2022-0971 Use after free in Blink Layout Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Amazon AWS Security Advisories

CVE-2022-0778 awareness

Github Security Advisories

[GHSA-4fc4-4p5g-6w89] HTML processing vulnerability allowing to execute JavaScript code [GHSA-6x2m-w449-qwx7] Code Injection in CRI-O [GHSA-w2j5-3rcx-vx7x] Sysctls applied to containers with host IPC or host network namespaces can affect the host [GHSA-2xmm-g482-4439] DQL injection through sorting parameters blocked [GHSA-rjmq-6v55-4rjv] Improper Authorization in org.cometd.oort [GHSA-7j52-6fjp-58gr] Inconsistent storage layout for ERC2771ContextUpgradeable [GHSA-gw5h-h6hj-f56g] Improper Authorization in Gogs [GHSA-q347-cg56-pcq4] SSRF in repository migration [GHSA-32gv-6cf3-wcmq] HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods [GHSA-4vvg-x86p-mvqc] Leaking of user information on Cross-Domain communication in sysend [GHSA-4qrp-27r3-66fj] Improper sanitize of SVG files during content upload ('Cross-site Scripting') in sylius/sylius [GHSA-mf3v-f2qq-pf9g] Insufficient Session Expiration in Sylius [GHSA-7563-75j9-6h5p] Sensitive Information Exposure in Sylius [GHSA-cfhh-xgwq-5r67] Sudden swap of user auth tokens [GHSA-4jp3-q2qm-9fmw] Improper Restriction of Rendered UI Layers or Frames in Sylius