2022-35 - Apple, Mozilla, Canonical, Red Hat, Microsoft, GitHub Published on September 5, 2022

Advisory Week

Week 35, 2022

Apple Security Advisory

iOS 12.5.6 Security Content

National Cyber Awareness System

Mozilla Releases Security Update for Thunderbird CISA, NSA, and ODNI Release Part One of Guidance on Securing the Software Supply Chain Apple Releases Security Updates for Multiple Products CISA releases two Industrial Control Systems Advisories CISA Releases 12 Industrial Control Systems Advisories

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 102.2.1 mfsa2022-38

Ubuntu Security Notices

USN-5591-4: Linux kernel (AWS) vulnerability USN-5596-1: Linux kernel (OEM) vulnerabilities USN-5595-1: Linux kernel vulnerabilities USN-5594-1: Linux kernel vulnerabilities USN-5593-1: Zstandard vulnerability USN-5587-1: curl vulnerability USN-5592-1: Linux kernel vulnerabilities USN-5591-3: Linux kernel vulnerability USN-5591-2: Linux kernel (HWE) vulnerability USN-5591-1: Linux kernel vulnerability USN-5590-1: Linux kernel (OEM) vulnerability USN-5589-1: Linux kernel vulnerabilities USN-5588-1: Linux kernel vulnerability USN-5572-2: Linux kernel (AWS) vulnerabilities USN-5585-1: Jupyter Notebook vulnerabilities USN-5586-1: SDL vulnerability USN-5584-1: Schroot vulnerability USN-5583-1: systemd vulnerability

Red Hat Security Advisory

(RHSA-2022:6314) Important: pcs security update (RHSA-2022:6313) Important: pcs security update (RHSA-2022:6312) Important: pcs security update (RHSA-2022:6306) Moderate: rh-mariadb103-galera and rh-mariadb103-mariadb security and bug fix update (RHSA-2022:6292) Important: Red Hat AMQ Broker 7.8.7 release and security update (RHSA-2022:6152) Important: Secondary Scheduler Operator for Red Hat OpenShift 1.1.0 security update (RHSA-2022:6290) Moderate: OpenShift API for Data Protection (OADP) 1.1.0 security and bug fix update (RHSA-2022:6283) Moderate: Red Hat OpenShift Service Mesh 2.2.2 Containers security update (RHSA-2022:6277) Moderate: Red Hat OpenShift Service Mesh 2.1.5 security update (RHSA-2022:6272) Moderate: Red Hat OpenShift Service Mesh 2.0.11 security update (RHSA-2022:6271) Moderate: Red Hat Advanced Cluster Management 2.3.12 security updates and bug fixes (RHSA-2022:6269) Moderate: convert2rhel security, bug fix, and enhancement update (RHSA-2022:6268) Moderate: convert2rhel security, bug fix, and enhancement update (RHSA-2022:6266) Moderate: convert2rhel security update (RHSA-2022:6133) Important: OpenShift Container Platform 4.10.30 bug fix and security update (RHSA-2022:6147) Important: OpenShift Container Platform 4.9.47 bug fix and security update (RHSA-2022:6250) Moderate: booth security update (RHSA-2022:6248) Moderate: kernel-rt security and bug fix update (RHSA-2022:6243) Moderate: kernel security and bug fix update (RHSA-2022:6224) Moderate: openssl security and bug fix update (RHSA-2022:6206) Important: systemd security update

Microsoft Security

Chromium: CVE-2022-3075 Insufficient data validation in Mojo Chromium: CVE-2022-3058 Use after free in Sign-In Flow Chromium: CVE-2022-3057 Inappropriate implementation in iframe Sandbox Chromium: CVE-2022-3056 Insufficient policy enforcement in Content Security Policy Chromium: CVE-2022-3055 Use after free in Passwords Chromium: CVE-2022-3054 Insufficient policy enforcement in DevTools Chromium: CVE-2022-3053 Inappropriate implementation in Pointer Lock Chromium: CVE-2022-3047 Insufficient policy enforcement in Extensions API Chromium: CVE-2022-3046 Use after free in Browser Tag Chromium: CVE-2022-3045 Insufficient validation of untrusted input in V8 Chromium: CVE-2022-3044 Inappropriate implementation in Site Isolation Chromium: CVE-2022-3041 Use after free in WebSQL Chromium: CVE-2022-3040 Use after free in Layout Chromium: CVE-2022-3039 Use after free in WebSQL Chromium: CVE-2022-3038 Use after free in Network Service Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Github Security Advisories

[GHSA-r6v9-p59m-gj2p] Remote code execution in Indy's NODE_UPGRADE transaction [GHSA-qf7j-25g9-r63f] elrond-go MultiESDTNFTTransfer call on a SC address with missing function name [GHSA-rp4v-hhm6-rcv9] Pinniped Supervisor Insufficient Session Expiration vulnerability [GHSA-xwf3-6rgv-939r] Flux CLI Workload Injection [GHSA-gp7f-rwcx-9369] jsoup may not sanitize code injection XSS attempts if SafeList.preserveRelativeLinks is enabled [GHSA-6qv6-q77g-7qm6] NVFLARE unsafe deserialization due to Pickle [GHSA-rvgm-35jw-q628] Improper Control of Generation of Code ('Code Injection') in mdx-mermaid [GHSA-vqc4-v8hc-h2jg] Polynomial regular expression used on uncontrolled data in nitrado.js [GHSA-prrh-qvhf-x788] Cross-site Scripting in prestashop/productcomments [GHSA-jhjh-776m-4765] Denial of service due to incorrect application of event authorization rules [GHSA-c8fj-4pm8-mp2c] Broken Authorization in ZITADEL Actions [GHSA-8mgq-6r2q-82w9] Captcha Bypass in strapi-plugin-ezforms [GHSA-rv3r-vqjj-8c76] Cross-site scripting from content entered in the tags and multiselect fields [GHSA-7hfp-qfw3-5jxh] Denial of service through string value parsing [GHSA-wff4-fpwg-qqv3] Unexpected server crash in Next.js [GHSA-p4cc-w597-6cpm] Cryptographically weak PRNG in `utils.generateUUID` [GHSA-56x4-j7p9-fcf9] Command Injection in moment-timezone [GHSA-v78c-4p63-2j6c] Cleartext Transmission of Sensitive Information in moment-timezone [GHSA-77qm-wvqq-fg79] Directus vulnerable to unhandled exception on illegal filename_disk value [GHSA-pfhr-pccp-hwmh] Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels [GHSA-grvv-h2f9-7v9c] gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth [GHSA-fcg8-mg9g-6hc4] .NET Denial of Service Vulnerability [GHSA-3rq8-h3gj-r5c6] .NET Denial of Service Vulnerability [GHSA-3f89-869f-5w76] Cross-site scripting from dynamic options in the multiselect field