Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 102.11 mfsa2023-18 Security Vulnerabilities fixed in Firefox ESR 102.11 mfsa2023-17 Security Vulnerabilities fixed in Firefox 113 mfsa2023-16

Ubuntu Security Notices

os-brick vulnerability: USN-6073-4 Nova vulnerability: USN-6073-3 Glance_store vulnerability: USN-6073-2 Cinder vulnerability: USN-6073-1 Linux kernel (OEM) vulnerabilities: USN-6072-1 / USN-6071-1 Linux kernel vulnerabilities: USN-6070-1 Linux kernel (Raspberry Pi) vulnerability: USN-6069-1 Open vSwitch vulnerability: USN-6068-1 OpenStack Neutron vulnerabilities: USN-6067-1 OpenStack Heat vulnerability: USN-6066-1 css-what vulnerabilities: USN-6065-1 SQL parse vulnerability: USN-6064-1 Ceph vulnerabilities: USN-6063-1 FreeType vulnerability: USN-6062-1 MySQL vulnerabilities: USN-6060-2 / USN-6060-1 WebKitGTK vulnerabilities: USN-6061-1 Erlang vulnerability: USN-6059-1

Red Hat Security Advisory

Moderate: Red Hat OpenShift Distributed Tracing 2.8.0 security update: RHSA-2023:2728 Moderate: OpenShift Security Profiles Operator bug fix update: RHSA-2023:2029 Moderate: OpenShift Container Platform 4.12.16 security update: RHSA-2023:2110 / RHSA-2023:2111 Moderate: Red Hat Data Grid 8.4.2 security update: RHSA-2023:2723 Moderate: Red Hat Single Sign-On 7.6.3 security update: RHSA-2023:2713 / RHSA-2023:2705 Moderate: Red Hat Single Sign-On 7.6.3 for OpenShift image security update: RHSA-2023:2710 Moderate: Red Hat Single Sign-On 7.6.3 security update on RHEL 7: RHSA-2023:2705 Moderate: nodejs and nodejs-nodemon security, bug fix, and enhancement update: RHSA-2023:2655 Important: pcs security and bug fix update: RHSA-2023:2652 Moderate: unbound security update: RHSA-2023:2370 Moderate: emacs security and bug fix update: RHSA-2023:2366 Moderate: gdk-pixbuf2 security update: RHSA-2023:2216 Moderate: Image Builder security, bug fix, and enhancement update: RHSA-2023:2204 Moderate: freerdp security update: RHSA-2023:2326 Moderate: sysstat security and bug fix update: RHSA-2023:2234 Low: curl security update: RHSA-2023:2478 Moderate: xorg-x11-server-Xwayland security update: RHSA-2023:2249 Moderate: git security and bug fix update: RHSA-2023:2319 Moderate: poppler security and bug fix update: RHSA-2023:2259 Low: libarchive security update: RHSA-2023:2532 Moderate: fwupd security and bug fix update: RHSA-2023:2487 Moderate: libtiff security update: RHSA-2023:2340 Low: openssl security and bug fix update: RHSA-2023:2523 Moderate: bind security and bug fix update: RHSA-2023:2261 Moderate: libtpms security update: RHSA-2023:2453 Moderate: postgresql-jdbc security update: RHSA-2023:2378 Moderate: wireshark security and bug fix update: RHSA-2023:2373 Moderate: gstreamer1-plugins-good security update: RHSA-2023:2260 Moderate: pki-core security, bug fix, and enhancement update: RHSA-2023:2293 Moderate: python-mako security update: RHSA-2023:2258 Moderate: conmon security and bug fix update: RHSA-2023:2222 Moderate: podman security and bug fix update: RHSA-2023:2282 Moderate: xorg-x11-server security and bug fix update: RHSA-2023:2248 Moderate: php:8.1 security update: RHSA-2023:2417 Important: kernel security, bug fix, and enhancement update: RHSA-2023:2458 Moderate: jackson security update: RHSA-2023:2312 Moderate: device-mapper-multipath security and bug fix update: RHSA-2023:2459 Moderate: grafana-pcp security and enhancement update: RHSA-2023:2177 Moderate: qemu-kvm security, bug fix, and enhancement update: RHSA-2023:2162 Moderate: frr security, bug fix, and enhancement update: RHSA-2023:2202 Moderate: freeradius security and bug fix update: RHSA-2023:2166 Moderate: fence-agents security and bug fix update: RHSA-2023:2161 Moderate: butane security, bug fix, and enhancement update: RHSA-2023:2193

Microsoft Security

Microsoft May 2023 Security Update Guide Microsoft Teams Information Disclosure Vulnerability: CVE-2023-24881 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability: CVE-2023-28283 Windows SMB Denial of Service Vulnerability: CVE-2023-24898 Windows Graphics Component Elevation of Privilege Vulnerability: CVE-2023-24899 Server for NFS Denial of Service Vulnerability: CVE-2023-24939 Windows NTLM Security Support Provider Information Disclosure Vulnerability: CVE-2023-24900 Windows Pragmatic General Multicast (PGM) Denial of Service Vulnerability: CVE-2023-24940 Windows NFS Portmapper Information Disclosure Vulnerability: CVE-2023-24901 Windows Network File System Remote Code Execution Vulnerability: CVE-2023-24941 Win32k Elevation of Privilege Vulnerability: CVE-2023-24902 / CVE-2023-29336 Remote Procedure Call Runtime Denial of Service Vulnerability: CVE-2023-24942 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability: CVE-2023-24903 Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability: CVE-2023-24943 Remote Desktop Client Remote Code Execution Vulnerability: CVE-2023-24905 Windows Bluetooth Driver Information Disclosure Vulnerability: CVE-2023-24944 Windows iSCSI Target Service Information Disclosure Vulnerability: CVE-2023-24945 Windows Backup Service Elevation of Privilege Vulnerability: CVE-2023-24946 Windows Bluetooth Driver Remote Code Execution Vulnerability: CVE-2023-24947 Windows Bluetooth Driver Elevation of Privilege Vulnerability: CVE-2023-24948 Windows Kernel Elevation of Privilege Vulnerability: CVE-2023-24949 Microsoft SharePoint Server Spoofing Vulnerability: CVE-2023-24950 Microsoft Excel Remote Code Execution Vulnerability: CVE-2023-24953 Microsoft SharePoint Server Information Disclosure Vulnerability: CVE-2023-24954 Microsoft SharePoint Server Remote Code Execution Vulnerability: CVE-2023-24955 Windows MSHTML Platform Security Feature Bypass Vulnerability: CVE-2023-29324 Microsoft Word Security Feature Bypass Vulnerability: CVE-2023-29335 Visual Studio Code Information Disclosure Vulnerability: CVE-2023-29338 AV1 Video Extension Remote Code Execution Vulnerability: CVE-2023-29340 / CVE-2023-29341 SysInternals Sysmon for Windows Elevation of Privilege Vulnerability: CVE-2023-29343 Secure Boot Security Feature Bypass Vulnerability: CVE-2023-24932 Windows Driver Revocation List Security Feature Bypass Vulnerability: CVE-2023-28251 Microsoft Remote Desktop app for Windows Information Disclosure Vulnerability: CVE-2023-28290 Windows Installer Elevation of Privilege Vulnerability: CVE-2023-24904 Windows OLE Remote Code Execution Vulnerability: CVE-2023-29325 Microsoft Access Denial of Service Vulnerability: CVE-2023-29333 Microsoft Office Remote Code Execution Vulnerability: CVE-2023-29344

Github Security Advisories

[GHSA-j5fj-rfh6-qj85] Planet's secret file is created with excessive permissions [GHSA-3p37-3636-q8wv] Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment [GHSA-6r8q-pfpv-7cgj] Vyper vulnerable to integer overflow in loop [GHSA-ph9x-4vc9-m39g] Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls [GHSA-2mhh-27v7-3vcx] WWBN AVideo command injection vulnerability [GHSA-gvrq-cg5r-7chp] Vert.x STOMP server process client frames that would not send initially a connect frame [GHSA-3p4g-rcw5-8298] etcd Key name can be accessed via LeaseTimeToLive API [GHSA-g8ph-74m6-8m7r] ClickHouse vulnerable to client certificate password exposure in client exception [GHSA-8vx6-69vg-c46f] Buffer under-read in workerd [GHSA-jjgp-whrp-gq8m] in-toto: PGP trust model not (fully) considered [GHSA-wc64-c5rv-32pf] in-toto vulnerable to Configuration Read From Local Directory [GHSA-w766-3572-f2hv] Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations [GHSA-mq3x-qgwx-3rfw] Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection [GHSA-2q89-485c-9j2x] Improper random reading in CIRCL [GHSA-qvqg-6rp8-4p9h] github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak [GHSA-q3j6-22wf-3jh9] github.com/ipfs/go-bitswap vulnerable to DOS unbounded persistent memory leak [GHSA-hqxw-f8mx-cpmw] distribution catalog API endpoint can lead to OOM via malicious user input [GHSA-6gf5-c898-7rxp] Improper Neutralization of Script in Attributes in XWiki (X)HTML renderers [GHSA-36fm-j33w-c25f] Privilege escalation (PR)/RCE from account through class sheet [GHSA-m974-xj4j-7qv5] Boxo bitswap/server: DOS unbounded persistent memory leak [GHSA-mhpj-7m7h-8p6x] Pimcore Cross-site Scripting (XSS) in Static Routes name field [GHSA-p744-4q6p-hvc2] Wings vulnerable to escape to host from installation container [GHSA-pqj7-jx24-wj7w] VTAdmin users that can create shards can deny access to other functions [GHSA-x99j-r8vv-gwwj] Pimcore vulnerable to Business Logic Errors via Customer automation rules [GHSA-m6m9-gr85-79vm] Pimcore Cross-site Scripting (XSS) in name field of Custom Reports [GHSA-q7cc-m6jw-m262] Pimcore Cross-site Scripting (XSS) in Predefined Properties delete [GHSA-r3fg-3r88-6x3f] Ibexa User Settings are accessible on the front-end for anonymous user [GHSA-g8xc-6mf7-h28h] OpenSearch issue with fine-grained access control during extremely rare race conditions [GHSA-pv7v-ph6g-3gxv] Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml [GHSA-93xx-cvmc-9w3v] On a compromised node, the fluid-csi service account can be used to modify node specs [GHSA-j9h5-vcgv-2jfm] XWiki Platform vulnerable to RXSS via editor parameter - importinline template

CISA Known Exploted Vulnerabilities

Microsoft Win32K Privilege Escalation Vulnerability CVE-2023-29336 Multiple Ruckus Wireless Products CSRF and RCE Vulnerability CVE-2023-25717 Red Hat Polkit Incorrect Authorization Vulnerability CVE-2021-3560 Linux Kernel Race Condition Vulnerability CVE-2014-0196 Linux Kernel Improper Input Validation Vulnerability CVE-2010-3904 Jenkins User Interface (UI) Information Disclosure Vulnerability CVE-2015-5317 Oracle Java SE and JRockit Unspecified Vulnerability CVE-2016-3427 Apache Tomcat Remote Code Execution Vulnerability CVE-2016-8735

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.