Apple Security Advisory

Safari 17.1.2 Security Content iOS 17.1.2 and iPadOS 17.1.2 Security Content macOS Sonoma 14.1.2 Security Content

National Cyber Awareness System

CISA Removes One Known Exploited Vulnerability From Catalog Apple Releases Security Updates for Multiple Products CISA and Partners Release Joint Advisory on IRGC-Affiliated Cyber Actors Exploiting PLCs CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA Releases Four Industrial Control Systems Advisories Multiple Vulnerabilities Affecting Web-Based Court Case and Document Management Systems CISA Releases First Secure by Design Alert CISA Releases Four Industrial Control Systems Advisories Exploitation of Unitronics PLCs used in Water and Wastewater Systems CISA and UK NCSC Unveil Joint Guidelines for Secure AI System Development

Ubuntu Security Notices

Linux kernel vulnerabilities: USN-6494-2 / USN-6495-2 / USN-6496-2 / USN-6502-4 OpenJDK 8 vulnerabilities: USN-6528-1 OpenJDK vulnerabilities: USN-6527-1 GStreamer Bad Plugins vulnerabilities: USN-6526-1 EC2 hibagent update: USN-6519-2 / USN-6519-1 pysha3 vulnerability: USN-6525-1 PyPy vulnerability: USN-6524-1 u-boot-nezha vulnerability: USN-6523-1 FreeRDP vulnerabilities: USN-6522-1 GIMP vulnerabilities: USN-6521-1 Linux kernel (NVIDIA) vulnerabilities: USN-6502-3 Linux kernel (StarFive) vulnerabilities: USN-6520-1 AFFLIB vulnerability: USN-6518-1 poppler regression: USN-6508-2 LSN-0099-1: Kernel Live Patch Security Notice Python vulnerability: USN-6513-2 LibTomMath vulnerability: USN-6402-2 Perl vulnerabilities: USN-6517-1 Linux kernel (Oracle) vulnerabilities: USN-6502-2 Linux kernel (Intel IoTG) vulnerabilities: USN-6516-1 Thunderbird vulnerabilities: USN-6515-1 Open vSwitch vulnerability: USN-6514-1

Red Hat Security Advisory

Important: Red Hat Build of Apache Camel for Quarkus 3.2.0 release (RHBQ 3.2.9.Final): RHSA-2023:7617 Important: postgresql security update: RHSA-2023:7616 / RHSA-2023:7545 Important: Red Hat Quay security update: RHSA-2023:7341 Important: Red Hat build of Quarkus 3.2.9 release and security update: RHSA-2023:7612 Important: Updated IBM Business Automation Manager Open Editions 8.0.4 SP1 Images: RHSA-2023:7587 Important: postgresql:13 security update: RHSA-2023:7581 / RHSA-2023:7580 / RHSA-2023:7579 Critical: squid security update: RHSA-2023:7578 / RHSA-2023:7576 Important: firefox security update: RHSA-2023:7577 / RHSA-2023:7573 / RHSA-2023:7569 / RHSA-2023:7511 / RHSA-2023:7507 Important: thunderbird security update: RHSA-2023:7574 / RHSA-2023:7570 / RHSA-2023:7506 / RHSA-2023:7502 / RHSA-2023:7500 / RHSA-2023:7499 Important: OpenShift Container Platform 4.14.4 bug fix and security update: RHSA-2023:7470 Important: OpenShift Container Platform 4.14.4 security and extras update: RHSA-2023:7469 Moderate: OpenShift Container Platform 4.13.24 packages and security update: RHSA-2023:7477 Important: OpenShift Container Platform 4.11.54 packages and security update: RHSA-2023:7481 Important: OpenShift Container Platform 4.13.24 bug fix and security update: RHSA-2023:7475 Important: OpenShift Container Platform 4.11.54 bug fix and security update: RHSA-2023:7479 Important: OpenShift Container Platform 4.11.54 security and extras update: RHSA-2023:7478 Important: OpenShift Container Platform 4.13.24 security and extras update: RHSA-2023:7474 Important: kpatch-patch security update: RHSA-2023:7559 / RHSA-2023:7558 / RHSA-2023:7554 Important: kernel security and bug fix update: RHSA-2023:7557 / RHSA-2023:7549 Important: OpenShift API for Data Protection (OADP) 1.3.0 security update: RHSA-2023:7555 Important: kernel-rt security update: RHSA-2023:7551 / RHSA-2023:7548 Moderate: libxml2 security update: RHSA-2023:7544 Low: curl security and bug fix update: RHSA-2023:7540 Moderate: c-ares security update: RHSA-2023:7543 Important: kernel security, bug fix, and enhancement update: RHSA-2023:7539 Moderate: fence-agents security update: RHSA-2023:7528 / RHSA-2023:7523 Important: tigervnc security update: RHSA-2023:7526 Important: OpenShift Virtualization 4.13.6 security and bug fix update: RHSA-2023:7522 Important: OpenShift Virtualization 4.13.6 RPMs security and bug fix update: RHSA-2023:7521 Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update: RHSA-2023:7517 Important: Red Hat OpenShift for Windows Containers 9.0.0 security update: RHSA-2023:7515

Microsoft Security

Microsoft December 2023 Security Update Guide Chromium: CVE-2023-6351 Use after free in libavif Chromium: CVE-2023-6350 Out of bounds memory access in libavif Chromium: CVE-2023-6348 Type Confusion in Spellcheck Chromium: CVE-2023-6347 Use after free in Mojo Chromium: CVE-2023-6346 Use after free in WebAudio Chromium: CVE-2023-6345 Integer overflow in Skia

Github Security Advisories

[GHSA-wj7f-468m-6mv8] Environment variables still accessible through /proc [GHSA-7m48-wc93-9g85] ASAR Integrity bypass via filetype confusion in electron [GHSA-7vwr-g6pm-9hc8] Cookie leakage between different users in fastapi-proxy-lib [GHSA-6g3j-p5g6-992f] OpenSearch StackOverflow vulnerability [GHSA-r8j9-5cj7-cv39] Reflected XSS Vulnerability in dpaste [GHSA-j24h-xcpc-9jw8] Eclipse IDE XXE in eclipse.platform [GHSA-prr3-c3m5-p7q2] @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity [GHSA-rvx8-p3xp-fj3p] October CMS stored XSS by authenticated backend user with improper configuration [GHSA-gxhx-g4fq-49hj] CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS [GHSA-p8q3-h652-65vx] October CMS safe mode bypass using Twig sandbox escape [GHSA-q22j-5r3g-9hmh] October CMS safe mode bypass using Page template injection [GHSA-8hc5-rmgf-qx6p] Keycloak vulnerable to LDAP Injection on UsernameForm Login [GHSA-2wmj-46rj-qm2w] ZITADEL Account Takeover via Malicious Host Header Injection [GHSA-c38w-74pg-36hr] Marvin Attack: potential key recovery through timing sidechannels [GHSA-jfhm-5ghh-2f97] cryptography vulnerable to NULL-dereference when loading PKCS7 certificates [GHSA-f678-j579-4xf5] Apache Superset - Elevation of Privilege [GHSA-ww7x-3gxh-qm6r] Validation of SignedInfo [GHSA-4233-7q5q-m7p6] google-translate-api-browser Server-Side Request Forgery (SSRF) Vulnerability [GHSA-88g2-xgh9-4ph2] OroCommerce get-totals-for-checkout API endpoint returns unwanted data [GHSA-8gwj-68w6-7v6c] OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility [GHSA-897w-jv7j-6r7g] OroCRMCallBundle has incorrect call view page visibility [GHSA-x2xm-p6vq-482g] OroCalendarBundle has incorrect system calendar events visibility [GHSA-9v3j-4j64-p937] OroPlatform vulnerable to path traversal during temporary file manipulations [GHSA-qmvj-4qr9-v547] Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler [GHSA-9wwg-r3c7-4vfg] Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls [GHSA-q3qx-c6g2-7pw2] aiohttp's ClientSession is vulnerable to CRLF injection via version [GHSA-qvrw-v9rv-5rjx] aiohttp's ClientSession is vulnerable to CRLF injection via method [GHSA-pjjw-qhg8-p2p9] aiohttp has vulnerable dependency that is vulnerable to request smuggling [GHSA-r68h-jhhj-9jvm] Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year [GHSA-hfxh-rjv7-2369] Uptime Kuma Authenticated remote code execution via TailscalePing

CISA Known Exploted Vulnerabilities

Google Skia Integer Overflow Vulnerability CVE-2023-6345 ownCloud graphapi Information Disclosure Vulnerability CVE-2023-49103

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.