2022年11月30日星期三

Google Chrome 多個漏洞

發佈日期: 2022年11月30日

風險: 中度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、遠端執行任意程式碼及繞過保安限制。


影響

  • 遠端執行程式碼
  • 阻斷服務
  • 繞過保安限制

受影響之系統或技術

  • Google Chrome 108.0.5359.71 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝軟件供應商提供的修補程式:

  • 更新至 108.0.5359.71 或之後版本

漏洞識別碼


資料來源


相關連結

Google Chrome Multiple Vulnerabilities

Release Date: 30 Nov 2022

RISK: Medium Risk

TYPE: Clients - Browsers

TYPE: Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and security restriction bypass on the targeted system.


Impact

  • Remote Code Execution
  • Denial of Service
  • Security Restriction Bypass

System / Technologies affected

  • Google Chrome prior to 108.0.5359.71

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

  • Update to version 108.0.5359.71 or later

Vulnerability Identifier


Source


Related Link

2022年11月29日星期二

Microsoft Edge 遠端執行程式碼漏洞

發佈日期: 2022年11月29日

風險: 極高度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Microsoft Edge 發現一個漏洞。遠端攻擊者可利用這個漏洞,於目標系統觸發遠端執行程式碼。

 

注意:

CVE-2022-4135 漏洞正被廣泛利用。


影響

  • 遠端執行程式碼

受影響之系統或技術

  • Microsoft Edge 107.0.1418.62 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝軟件供應商提供的修補程式:

  • 更新至 107.0.1418.62 或之後版本

漏洞識別碼


資料來源


相關連結

Microsoft Edge Remote Code Execution Vulnerability

Release Date: 29 Nov 2022

RISK: Extremely High Risk

TYPE: Clients - Browsers

TYPE: Browsers

A vulnerability was identified in Microsoft Edge. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

 

Note:

CVE-2022-4135 is being exploited in the wild.


Impact

  • Remote Code Execution

System / Technologies affected

  • Microsoft Edge prior to 107.0.1418.62

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

  • Update to version 107.0.1418.62 or later

Vulnerability Identifier


Source


Related Link

F5 產品資料篡改漏洞

發佈日期: 2022年11月28日

風險: 中度風險

類型: 操作系統 - Network

類型: Network

於 F5 產品發現一個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、洩露敏感資料及資料篡改。

 


影響

  • 阻斷服務
  • 篡改
  • 資料洩露

受影響之系統或技術

BIG-IP

  • 17.0.0
  • 16.1.0 - 16.1.3
  • 15.1.0 - 15.1.8
  • 14.1.0 - 14.1.5
  • 13.1.0 - 13.1.5

 

BIG-IQ Centralized Management

  • 8.0.0 - 8.2.0
  • 7.0.0 - 7.1.0

 

Traffix SDC

  • 5.2.0
  • 5.1.0

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

F5 Products Data Manipulation Vulnerability

Release Date: 28 Nov 2022

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

TYPE: Networks OS

A vulnerability has been identified in F5 Products. A remote attacker could exploit this vulnerability to trigger denial of service condition, sensitive information disclosure and data manipulation on the targeted system.

 


Impact

  • Denial of Service
  • Data Manipulation
  • Information Disclosure

System / Technologies affected

BIG-IP

  • 17.0.0
  • 16.1.0 - 16.1.3
  • 15.1.0 - 15.1.8
  • 14.1.0 - 14.1.5
  • 13.1.0 - 13.1.5

 

BIG-IQ Centralized Management

  • 8.0.0 - 8.2.0
  • 7.0.0 - 7.1.0

 

Traffix SDC

  • 5.2.0
  • 5.1.0

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

2022年11月26日星期六

Google Chrome 遠端執行程式碼漏洞

發佈日期: 2022年11月25日

風險: 極高度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Google Chrome 發現一個漏洞。遠端攻擊者可利用這個漏洞,於目標系統觸發遠端執行程式碼。

 

注意:

CVE-2022-4135 漏洞正被廣泛利用。


影響

  • 遠端執行程式碼

受影響之系統或技術

  • Google Chrome 107.0.5304.121 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝軟件供應商提供的修補程式:

  • 更新至 107.0.5304.121 或之後版本

漏洞識別碼


資料來源


相關連結

Google Chrome Remote Code Execution Vulnerability

Release Date: 25 Nov 2022

RISK: Extremely High Risk

TYPE: Clients - Browsers

TYPE: Browsers

A vulnerability was identified in Google Chrome. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

 

Note:

CVE-2022-4135 is being exploited in the wild.


Impact

  • Remote Code Execution

System / Technologies affected

  • Google Chrome prior to 107.0.5304.121

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

  • Update to version 107.0.5304.121 or later

Vulnerability Identifier


Source


Related Link

2022年11月24日星期四

 Updates to your Microsoft 365 subscription


Microsoft is committed to improving your Microsoft 365 subscription. As a result, we occasionally make changes to your features and benefits. This email provides details on one feature we plan to remove next year and an update to Microsoft storage.

  • Personalised email addresses in Outlook.com
    Starting 30/11/2023, you will no longer be able to associate a new personalised email address (e.g. yourname@example.com) with your Outlook.com mailbox. If you already have a personalised email address set up, you will not be impacted by this change, and you can continue using it without any disruption in service. After 30/11/2023, if you choose to remove your existing personalised email address, you will be unable to add it back.

 

  • Cloud Storage
    Starting 01/02/2023, cloud storage (1 TB¹) used across Microsoft 365 apps and services will include Outlook.com attachments data and OneDrive data. All data will continue to be protected with Microsoft’s comprehensive set of security features. This update will not impact your Outlook.com mailbox storage amount. However, this may reduce how much cloud storage you have available to use with your OneDrive. If you reach your cloud storage quota, your ability to send and receive emails in Outlook.com will be disrupted. During the transition, we’re adding at least an extra 50 GB to your cloud storage for 1 year starting on 01/02/2023. This extra storage expires after a year.

As a reminder, your Microsoft 365 subscription benefits also include premium versions of Word, Excel and PowerPoint, 1 TB of cloud storage to back up files and photos, advanced security protection in OneDrive and Outlook, and the ability to contact support via chat or phone at no extra cost throughout your subscription term, plus more. We also recently launched two new apps available with your subscription, Microsoft Defender² and Clipchamp³.

If you do not wish to continue your Microsoft 365 subscription, you can cancel it by logging into your Microsoft account and turning off recurring billing. Learn more in our FAQ. If you have additional questions, please contact our support team.


2022年11月21日星期一

Linux 內核多個漏洞

最後更新 2022年11月21日 發佈日期: 2022年11月10日

風險: 中度風險

類型: 操作系統 - LINUX

類型: LINUX

於Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料、繞過保安限制及跨網站指令碼。

 

[更新於 2022-11-14] 

更新受影響之系統或技術,解決方案及相關連結。

 

[更新於 2022-11-17] 

更新影響,受影響之系統或技術,解決方案,漏洞識別碼及相關連結。

 

[更新於 2022-11-21] 

更新受影響之系統或技術,解決方案,漏洞識別碼及相關連結。


影響

  • 阻斷服務
  • 權限提升
  • 資料洩露
  • 遠端執行程式碼
  • 繞過保安限制
  • 跨網站指令碼

受影響之系統或技術

  • openSUSE Leap 15.3
  • openSUSE Leap 15.4
  • openSUSE Leap Micro 5.2
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Real Time 8 x86_64
  • Red Hat Enterprise Linux for Real Time 9 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
  • Red Hat Satellite 6.12 x86_64
  • Red Hat Satellite Capsule 6.12 x86_64
  • Red Hat Virtualization Host 4 for RHEL 8 x86_64
  • SUSE Linux Enterprise High Performance Computing 15
  • SUSE Linux Enterprise High Performance Computing 15-SP1
  • SUSE Linux Enterprise High Performance Computing 15-SP2
  • SUSE Linux Enterprise High Performance Computing 15-SP3
  • SUSE Linux Enterprise High Performance Computing 15-SP4
  • SUSE Linux Enterprise Live Patching 12-SP4
  • SUSE Linux Enterprise Live Patching 12-SP5
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Module for Live Patching 15
  • SUSE Linux Enterprise Module for Live Patching 15-SP1
  • SUSE Linux Enterprise Module for Live Patching 15-SP2
  • SUSE Linux Enterprise Module for Live Patching 15-SP3
  • SUSE Linux Enterprise Module for Live Patching 15-SP4
  • SUSE Linux Enterprise Module for Public Cloud 15-SP3
  • SUSE Linux Enterprise Module for Public Cloud 15-SP4
  • SUSE Linux Enterprise Module for Realtime 15-SP3
  • SUSE Linux Enterprise Real Time 15-SP3
  • SUSE Linux Enterprise Real Time Extension 12-SP5
  • SUSE Linux Enterprise Server 15
  • SUSE Linux Enterprise Server 15-SP1
  • SUSE Linux Enterprise Server 15-SP2
  • SUSE Linux Enterprise Server 15-SP3
  • SUSE Linux Enterprise Server 15-SP4
  • SUSE Linux Enterprise Server for SAP Applications 15
  • SUSE Linux Enterprise Server for SAP Applications 15-SP1
  • SUSE Linux Enterprise Server for SAP Applications 15-SP2
  • SUSE Linux Enterprise Server for SAP Applications 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications 15-SP4
  • SUSE Linux Enterprise Storage 7.1
  • SUSE Manager Proxy 4.2
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.2
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.2
  • SUSE Manager Server 4.3

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

對於 RedHat

安裝供應商提供的修補程式:

 

對於 SUSE

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

Linux Kernel Multiple Vulnerabilities

Last Update Date: 21 Nov 2022 Release Date: 10 Nov 2022

RISK: Medium Risk

TYPE: Operating Systems - Linux

TYPE: Linux

Multiple vulnerabilities were identified in Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure, security restriction bypass and cross-site scripting on the targeted system.

 

[Updated on 2022-11-14] 

Updated System / Technologies affected, Solutions and Related Links.

 

[Updated on 2022-11-17] 

Updated Impact, System / Technologies affected, Solutions, Vulnerability Identifier and Related Links.

 

[Updated on 2022-11-21] 

Updated System / Technologies affected, Solutions, Vulnerability Identifier and Related Links.


Impact

  • Denial of Service
  • Elevation of Privilege
  • Information Disclosure
  • Remote Code Execution
  • Security Restriction Bypass
  • Cross-Site Scripting

System / Technologies affected

  • openSUSE Leap 15.3
  • openSUSE Leap 15.4
  • openSUSE Leap Micro 5.2
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Real Time 8 x86_64
  • Red Hat Enterprise Linux for Real Time 9 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
  • Red Hat Satellite 6.12 x86_64
  • Red Hat Satellite Capsule 6.12 x86_64
  • Red Hat Virtualization Host 4 for RHEL 8 x86_64
  • SUSE Linux Enterprise High Performance Computing 15
  • SUSE Linux Enterprise High Performance Computing 15-SP1
  • SUSE Linux Enterprise High Performance Computing 15-SP2
  • SUSE Linux Enterprise High Performance Computing 15-SP3
  • SUSE Linux Enterprise High Performance Computing 15-SP4
  • SUSE Linux Enterprise Live Patching 12-SP4
  • SUSE Linux Enterprise Live Patching 12-SP5
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Module for Live Patching 15
  • SUSE Linux Enterprise Module for Live Patching 15-SP1
  • SUSE Linux Enterprise Module for Live Patching 15-SP2
  • SUSE Linux Enterprise Module for Live Patching 15-SP3
  • SUSE Linux Enterprise Module for Live Patching 15-SP4
  • SUSE Linux Enterprise Module for Public Cloud 15-SP3
  • SUSE Linux Enterprise Module for Public Cloud 15-SP4
  • SUSE Linux Enterprise Module for Realtime 15-SP3
  • SUSE Linux Enterprise Real Time 15-SP3
  • SUSE Linux Enterprise Real Time Extension 12-SP5
  • SUSE Linux Enterprise Server 15
  • SUSE Linux Enterprise Server 15-SP1
  • SUSE Linux Enterprise Server 15-SP2
  • SUSE Linux Enterprise Server 15-SP3
  • SUSE Linux Enterprise Server 15-SP4
  • SUSE Linux Enterprise Server for SAP Applications 15
  • SUSE Linux Enterprise Server for SAP Applications 15-SP1
  • SUSE Linux Enterprise Server for SAP Applications 15-SP2
  • SUSE Linux Enterprise Server for SAP Applications 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications 15-SP4
  • SUSE Linux Enterprise Storage 7.1
  • SUSE Manager Proxy 4.2
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.2
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.2
  • SUSE Manager Server 4.3

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

For RedHat

Apply fixes issued by the vendor:

 

For SUSE

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

2022年11月19日星期六

思科產品多個漏洞

發佈日期: 2022年11月18日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

類型: 保安軟件及應用設備

在思科產品發現多個漏洞,遠端攻擊者可利用這些漏洞在目標系統觸發遠端執行程式碼、跨網站指令碼及繞過保安限制。


影響

  • 遠端執行程式碼
  • 跨網站指令碼
  • 繞過保安限制

受影響之系統或技術

  • 思科 ISE

 

詳情請參閱以下連結﹕


解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

Cisco Products Multiple Vulnerabilities

Release Date: 18 Nov 2022

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

TYPE: Security Software & Appliance

Multiple vulnerabilities were identified in Cisco Products. A remote attacker could exploit some of these vulnerabilities to remote code execution, cross-site scripting and Security Restriction Bypass on the targeted system.


Impact

  • Remote Code Execution
  • Cross-Site Scripting
  • Security Restriction Bypass

System / Technologies affected

  • Cisco ISE

 

Please refer to the link below for detail:


Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

惡意軟件警報 - 零售商成為 Scattered Spider 黑客組織勒索軟件攻擊的目標

惡意軟件警報 - 零售商成為 Scattered Spider 黑客組織勒索軟件攻擊的目標 發佈日期: 2025年05月02日 類別: ...