2022-29 - Apple, Oracle, Cisco, Microsoft, GitHub Published on July 25, 2022

Advisory Week

Week 29, 2022

Apple Security Advisory

iOS 15.6 and iPadOS 15.6 Security Content tvOS 15.6 Security Content macOS Monterey 12.5 Security Content macOS Big Sur 11.6.8 Security Content Security Update 2022-005 Catalina Security Content watchOS 8.7 Security Content Safari 15.6 Security Content

Oracle Security Alerts

Oracle Critical Patch Update Advisory - July 2022

Cisco Security Advisory

Cisco Nexus Dashboard SSL Certificate Validation Vulnerability Cisco Identity Services Engine Administrator Password Lifetime Expiration Issue Cisco Nexus Dashboard Arbitrary File Write Vulnerability Cisco Nexus Dashboard Unauthorized Access Vulnerabilities Cisco Nexus Dashboard Privilege Escalation Vulnerabilities Cisco IoT Control Center Cross-Site Scripting Vulnerability Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Microsoft Security

Chromium: CVE-2022-2481 Use after free in Views Chromium: CVE-2022-2480 Use after free in Service Worker API Chromium: CVE-2022-2479 Insufficient validation of untrusted input in File Chromium: CVE-2022-2478 Use after free in PDF Chromium: CVE-2022-2477 Use after free in Guest View Azure Arc Jumpstart Information Disclosure Vulnerability

Github Security Advisories

[GHSA-m58q-qq5h-mgqq] Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository [GHSA-fjh6-p566-wr6q] skylot jadx affected by Incorrect Behavior Order in vulnerable dependency [GHSA-7f6x-jwh5-m9r4] Cranelift vulnerable to miscompilation of constant values in division on AArch64 [GHSA-4g63-c64m-25w9] OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers [GHSA-qh9x-gcfh-pcrw] OpenZeppelin Contracts's ERC165Checker may revert instead of returning false [GHSA-5cm2-9h8c-rvfx] TZInfo relative path traversal vulnerability allows loading of arbitrary files [GHSA-6rh6-x8ww-9h97] Grails framework Remote Code Execution via Data Binding [GHSA-q768-x9m6-m9qp] undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect [GHSA-3cvr-822r-rqcc] undici before v5.8.0 vulnerable to CRLF injection in request headers [GHSA-5fhj-g3p3-pq9g] Wasmtime vulnerable to Use After Free with `externref`s [GHSA-99j7-mhfh-w84p] Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs [GHSA-h6gj-6jjq-h8g9] jQuery UI Cross-site Scripting when refreshing a checkboxradio with an HTML-like initial text label