2023-35 - Mozilla, Canonical, Red Hat, Cisco, Microsoft, Google, GitHub Published on September 4, 2023

Advisory Week

Week 35, 2023

National Cyber Awareness System

VMware Releases Security Update for Tools CISA Releases Four Industrial Control Systems Advisories CISA and International Partners Release Malware Analysis Report on Infamous Chisel Mobile Malware CISA Warns of Hurricane-Related Scams Mozilla Releases Security Updates for Firefox and Firefox ESR CISA and FBI Publish Joint Advisory on QakBot Infrastructure VMware Releases Security Updates for Aria Operations for Networks Juniper Networks Releases Security Advisory for Junos OS and Junos OS Evolved CISA Releases IOCs Associated with Malicious Barracuda Activity CISA Releases One Industrial Control Systems Advisory

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 102.15 mfsa2023-37 Security Vulnerabilities fixed in Thunderbird 115.2 mfsa2023-38 Security Vulnerabilities fixed in Firefox 117 mfsa2023-34 Security Vulnerabilities fixed in Firefox ESR 102.15 mfsa2023-35 Security Vulnerabilities fixed in Firefox ESR 115.2 mfsa2023-36

Ubuntu Security Notices

Linux kernel (Azure) vulnerabilities: USN-6332-1 / USN-6331-1 Linux kernel (GCP) vulnerabilities: USN-6330-1 Linux kernel vulnerabilities: USN-6329-1 / USN-6325-1 / USN-6321-1 / USN-6318-1 / USN-6317-1 / USN-6315-1 / USN-6314-1 / USN-6312-1 / USN-6311-1 / USN-6309-1 Linux kernel (Oracle) vulnerabilities: USN-6328-1 Linux kernel (KVM) vulnerabilities: USN-6327-1 GitPython vulnerability: USN-6326-1 Linux kernel (GKE) vulnerabilities: USN-6324-1 FRR vulnerability: USN-6323-1 elfutils vulnerabilities: USN-6322-1 OpenJDK regression: USN-6263-2 Firefox vulnerabilities: USN-6320-1 AMD Microcode vulnerability: USN-6319-1 Linux kernel (OEM) vulnerabilities: USN-6316-1 FAAD2 vulnerabilities: USN-6313-1 json-c vulnerability: USN-6310-1 Libqb vulnerability: USN-6308-1

Red Hat Security Advisory

Important: Red Hat Single Sign-On 7.6.5 security update: RHSA-2023:4924 Important: Red Hat Single Sign-On 7.6.5 for OpenShift image enhancement and security update: RHSA-2023:4921 Moderate: Migration Toolkit for Containers (MTC) 1.7.12 security and bug fix update: RHSA-2023:4892 Important: DevWorkspace Operator 0.22 release: RHSA-2023:4889 Important: kpatch-patch security update: RHSA-2023:4888 / RHSA-2023:4834 / RHSA-2023:4829 Moderate: OpenShift Container Platform 4.13.10 security update: RHSA-2023:4734 / RHSA-2023:4731 / RHSA-2023:4730 Important: Red Hat OpenShift support for Windows Containers 8.0.2 security update: RHSA-2023:4885 Moderate: java-1.8.0-ibm security update: RHSA-2023:4877 / RHSA-2023:4876 Critical: Red Hat Advanced Cluster Management 2.8.1 security and bug fix updates: RHSA-2023:4875 Important: cups security update: RHSA-2023:4864 / RHSA-2023:4838 / RHSA-2023:4771 / RHSA-2023:4770 / RHSA-2023:4769 / RHSA-2023:4768 / RHSA-2023:4766 / RHSA-2023:4765 Critical: Multicluster Engine for Kubernetes 2.3.1 security updates and bug fixes: RHSA-2023:4862 Important: Red Hat OpenShift support for Windows Containers 5.1.2 security update: RHSA-2023:4835 Important: kernel-rt security and bug fix update: RHSA-2023:4817 Important: kernel security and bug fix update: RHSA-2023:4801 Important: kernel security, bug fix, and enhancement update: RHSA-2023:4789 Important: Red Hat OpenShift support for Windows Containers 6.0.2 security update: RHSA-2023:4780 Important: Red Hat OpenShift support for Windows Containers 7.1.1 security update: RHSA-2023:4777 Moderate: libxml2 security update: RHSA-2023:4767

Cisco Security Advisory

Cisco Unified Communications Products Privilege Escalation Vulnerability

Microsoft Security

Microsoft September 2023 Security Update Guide Chromium: CVE-2023-4572 Use after free in MediaStream

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop

Github Security Advisories

[GHSA-h24c-6p6p-m3vx] tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli [GHSA-wc9j-gc65-3cm7] DDFFileParser is vulnerable to XXE Attacks [GHSA-j5g3-5c8r-7qfx] Prevent logging invalid header values [GHSA-xjw2-6jm9-rf67] Sandbox escape via various forms of "format". [GHSA-hw6r-g8gj-2987] Actions expression injection in `filter-test-configs` (`GHSL-2023-181`) [GHSA-cwvm-v4w8-q58c] Blind local file inclusion [GHSA-8fjr-hghr-4m99] Archive spoofing vulnerability in borgbackup [GHSA-95rp-6gqp-6622] Command Injection Vulnerability in find-exec [GHSA-vmf9-6pcv-xr87] Username enumeration attack in goauthentik [GHSA-r726-vmfq-j9j3] Open Redirect Vulnerability in jupyter-server [GHSA-64x5-55rw-9974] cross-site inclusion (XSSI) of files in jupyter-server [GHSA-wfm5-v35h-vwf4] GitPython untrusted search path on Windows systems leading to arbitrary code execution [GHSA-hpx4-r86g-5jrg] @adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS [GHSA-ch3c-v47x-4pgp] Cleartext Signed Message Signature Spoofing in openpgp [GHSA-rq5c-hvw6-8pr7] Improper log output when using GitHub Status Notifications in spinnaker