2022-3 - Oracle, Canonical, Red Hat, Cisco, Microsoft, GitHub Published on January 24, 2022

Advisory Week

Week 3, 2022

Oracle Security Alerts

Oracle Critical Patch Update Advisory - January 2022

Ubuntu Security Notices

USN-5248-1: Thunderbird vulnerabilities USN-5249-1: USBView vulnerability USN-5246-1: Thunderbird vulnerabilities USN-5244-1: DBus vulnerability USN-5243-2: AIDE vulnerability USN-5243-1: AIDE vulnerability USN-5242-1: Open vSwitch vulnerability USN-5021-2: curl vulnerability LSN-0084-1: Kernel Live Patch Security Notice USN-5241-1: QtSvg vulnerabilities USN-5240-1: Linux kernel vulnerability USN-5233-2: ClamAV vulnerability USN-5234-1: Byobu vulnerability USN-5235-1: Ruby vulnerabilities USN-5233-1: ClamAV vulnerability USN-5227-2: Pillow vulnerabilities

Red Hat Security Advisory

(RHSA-2022:0230) Moderate: Red Hat OpenShift Enterprise Logging bug fix and security update (5.2.6) (RHSA-2022:0227) Moderate: Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.3) (RHSA-2022:0226) Moderate: Red Hat OpenShift Enterprise Logging bug fix and security update (5.1.7) (RHSA-2022:0225) Moderate: Red Hat OpenShift Enterprise Logging bug fix and security update (5.0.12) (RHSA-2022:0223) Moderate: Red Hat Integration Camel-K 1.6.3 release and security update (RHSA-2022:0222) Moderate: Red Hat Integration Camel Extensions for Quarkus 2.2 security update (RHSA-2022:0219) Moderate: Red Hat AMQ Streams 1.6.6 release and security update (RHSA-2022:0216) Low: Red Hat JBoss Enterprise Application Platform 7.4 security update (RHSA-2022:0083) Moderate: Red Hat build of Eclipse Vert.x 4.1.8 security update (RHSA-2022:0205) Moderate: Red Hat Data Grid 8.2.3 security update (RHSA-2022:0203) Critical: Red Hat Fuse 7.8-7.10 security update (RHSA-2022:0202) Moderate: Migration Toolkit for Containers (MTC) 1.6.3 security and bug fix update (RHSA-2022:0199) Important: libreswan security update (RHSA-2022:0191) Moderate: OpenShift Virtualization 4.9.2 Images security and bug fix update (RHSA-2022:0190) Moderate: Satellite 6.10.2 Async Bug Fix Update (RHSA-2022:0188) Important: kernel security and bug fix update (RHSA-2022:0186) Important: kernel security, bug fix, and enhancement update (RHSA-2022:0187) Important: kernel-rt security and bug fix update (RHSA-2022:0114) Moderate: OpenShift Container Platform 4.7.41 security update (RHSA-2022:0184) Important: gegl04 security update (RHSA-2022:0178) Important: gegl04 security update (RHSA-2022:0177) Important: gegl04 security update (RHSA-2022:0176) Important: kernel-rt security and bug fix update (RHSA-2022:0161) Moderate: java-17-openjdk security update (RHSA-2022:0164) Important: Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update (RHSA-2022:0163) Important: Cryostat security update (RHSA-2022:0162) Important: gegl security update (RHSA-2022:0158) Important: telnet security update (RHSA-2022:0157) Important: kernel security update (RHSA-2022:0155) Important: Red Hat Single Sign-On 7.5.1 security update (RHSA-2022:0152) Important: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 (RHSA-2022:0151) Important: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 (RHSA-2022:0146) Moderate: EAP XP 2 security update to CVE fixes in the EAP 7.3.x base (RHSA-2022:0143) Important: httpd security update

Cisco Security Advisory

ConfD CLI Command Injection Vulnerability Cisco Redundancy Configuration Manager for Cisco StarOS Software Multiple Vulnerabilities Multiple Cisco Products Snort Modbus Denial of Service Vulnerability Cisco Webex Meetings Cross-Site Scripting Vulnerability Multiple Cisco Products CLI Command Injection Vulnerability

Microsoft Security

Microsoft Edge for Android Spoofing Vulnerability WinVerifyTrust Signature Validation Vulnerability Chromium: CVE-2022-0311 Heap buffer overflow in Task Manager Chromium: CVE-2022-0310 Heap buffer overflow in Task Manager Chromium: CVE-2022-0309 Inappropriate implementation in Autofill Chromium: CVE-2022-0308 Use after free in Data Transfer Chromium: CVE-2022-0307 Use after free in Optimization Guide Chromium: CVE-2022-0306 Heap buffer overflow in PDFium Chromium: CVE-2022-0305 Inappropriate implementation in Service Worker API Chromium: CVE-2022-0304 Use after free in Bookmarks Chromium: CVE-2022-0303 Race in GPU Watchdog Chromium: CVE-2022-0302 Use after free in Omnibox Chromium: CVE-2022-0301 Heap buffer overflow in DevTools Chromium: CVE-2022-0300 Use after free in Text Input Method Editor Chromium: CVE-2022-0298 Use after free in Scheduling Chromium: CVE-2022-0297 Use after free in Vulkan Chromium: CVE-2022-0296 Use after free in Printing Chromium: CVE-2022-0295 Use after free in Omnibox Chromium: CVE-2022-0294 Inappropriate implementation in Push messaging Chromium: CVE-2022-0293 Use after free in Web packaging Chromium: CVE-2022-0292 Inappropriate implementation in Fenced Frames Chromium: CVE-2022-0291 Inappropriate implementation in Storage Chromium: CVE-2022-0290 Use after free in Site isolation Chromium: CVE-2022-0289 Use after free in Safe browsing

Github Security Advisories

[GHSA-xqxm-2rpm-3889] Comment reply notifications sent to incorrect users [GHSA-rhq2-3vr9-6mcr] Files on the host computer can be accessed from the Gradio interface [GHSA-883x-6fch-6wjx] Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares [GHSA-6r92-cgxc-r5fg] Denial of service in CBOR library [GHSA-v57x-gxfj-484q] Security Advisory for "Log4Shell" [GHSA-44m4-9cjp-j587] IBX-1392: Image filenames sanitization [GHSA-fj2w-wfgv-mwq6] Denial of service in CBOR library [GHSA-x7wr-283h-5h2v] Out-of-bounds Read in Onionshare [GHSA-jh82-c5jw-pxpc] Denial of Service in Onionshare [GHSA-ch22-x2v3-v6vq] OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend [GHSA-w9m4-7w72-r766] Improper Access Control in Onionshare [GHSA-gjj5-998g-v36v] Improper Access Control in Onionshare [GHSA-jgm9-xpfj-4fq6] Path traversal in Onionshare [GHSA-h29c-wcm8-883h] Incorrect Permission Assignment for Critical Resource in OnionShare [GHSA-99p8-9p2c-49j4] Improper Access Control in Onionshare [GHSA-68vr-8f46-vc9f] Username spoofing in OnionShare [GHSA-2457-2263-mm9f] Memory leak in micronaut-core [GHSA-8434-v7xw-8m9x] Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks [GHSA-h79x-98r2-g6qc] Impersonation of other users (passing XBOX Live authentication) by theft of logins in PocketMine-MP [GHSA-wjfq-88q2-r34j] Unhandled exception when decoding form response JSON [GHSA-pq7m-3gw7-gq5x] Execution with Unnecessary Privileges in ipython [GHSA-82v2-mx6x-wq7q] Incorrect Default Permissions in log4js [GHSA-7v3x-h7r2-34jv] Insufficient Session Expiration in Pterodactyl API [GHSA-rcrv-228c-gprj] Invalid URL generation in bitlyshortener