Apple Security Advisory

macOS Sonoma 14.2.1 Security Content

National Cyber Awareness System

CISA Releases Microsoft 365 Secure Configuration Baselines and SCuBAGear Tool CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA Releases Two Industrial Control Systems Advisories Mozilla Releases Security Updates for Firefox and Thunderbird Apple Releases Security Updates for Multiple Products CISA Releases Seven Industrial Control Systems Advisories CISA and FBI Release Advisory on ALPHV Blackcat Affiliates FBI, CISA, and ASD’s ACSC Release Advisory on Play Ransomware

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 115.6 mfsa2023-55 Security Vulnerabilities fixed in Firefox 121 mfsa2023-56 Security Vulnerabilities fixed in Firefox ESR 115.6 mfsa2023-54

Ubuntu Security Notices

libssh vulnerability: USN-6561-1 OpenSSH vulnerabilities: USN-6560-1

Red Hat Security Advisory

Important: tigervnc security update: RHSA-2023:7886 Important: postgresql:15 security update: RHSA-2023:7885 / RHSA-2023:7883 Low: openssl security update: RHSA-2023:7877 Moderate: opensc security update: RHSA-2023:7876 / RHSA-2023:7879 Important: gstreamer1-plugins-bad-free security update: RHSA-2023:7873 / RHSA-2023:7875 / RHSA-2023:7874 / RHSA-2023:7872 Important: postgresql:10 security update: RHSA-2023:7878

Microsoft Security

Microsoft December 2023 Security Update Guide Chromium: CVE-2023-7024 Heap buffer overflow in WebRTC

Github Security Advisories

[GHSA-vf5m-xrhm-v999] Nautobot missing object-level permissions enforcement when running Job Buttons [GHSA-hwcc-4cv8-cf3h] Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL) [GHSA-557v-xcg6-rm5m] Potential URI resolution path traversal in the AWS SDK for PHP [GHSA-mpwq-j3xf-7m5w] The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted [GHSA-6qm2-wpxq-7qh2] Gradio makes the `/file` secure against file traversal and server-side request forgery attacks [GHSA-3pjv-r7w4-2cf5] Grails data binding causes JVM crash and/or DoS [GHSA-wq59-4q6r-635r] Authentication bypass vulnerability in navidrome's subsonic endpoint [GHSA-9wgg-m99q-hhfc] Expired tokens can be renewed without validating the account password [GHSA-p5f8-qf24-24cj] Velocity execution without script right through tree macro [GHSA-7ww5-4wqc-m92c] containerd allows RAPL to be accessible to a container [GHSA-g56x-7j6w-g8r8] Grackle has StackOverflowError in GraphQL query processing [GHSA-w8vh-p74j-x9xp] yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation [GHSA-x3v3-8xg8-8v72] Sentry's Astro SDK vulnerable to ReDoS [GHSA-rw54-6826-c8j5] yiisoft/yii2-authclient's Oauth2 PKCE implementation is vulnerable [GHSA-r8xx-8vm8-x6wj] Resque vulnerable to Reflected Cross Site Scripting through pathnames [GHSA-gc3j-vvwf-4rp8] Resque vulnerable to reflected XSS in resque-web failed and queues lists [GHSA-r9mq-m72x-257g] Resque vulnerable to reflected XSS in Queue Endpoint [GHSA-4h72-34j6-j8x7] Maloja error page XSS vulnerability [GHSA-cvg2-7c3j-g36j] Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri [GHSA-9hmq-fm33-x4xx] Resque Scheduler Reflected XSS In Delayed Jobs View [GHSA-45x7-px36-x8w8] Russh vulnerable to Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC [GHSA-hfmc-7525-mj55] AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC

CISA Known Exploted Vulnerabilities

FXC AE1021, AE1021PE OS Command Injection Vulnerability CVE-2023-49897 QNAP VioStor NVR OS Command Injection Vulnerability CVE-2023-47565

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.