2023年2月27日星期一

Microsoft Edge 多個漏洞

發佈日期: 2023年02月27日

風險: 中度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發遠端執行程式碼及阻斷服務。


影響

  • 阻斷服務
  • 遠端執行程式碼

受影響之系統或技術

  • Microsoft Edge 110.0.1587.56 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝軟件供應商提供的修補程式:

  • 更新至 110.0.1587.56 或之後版本

漏洞識別碼


資料來源


相關連結

Microsoft Edge Multiple Vulnerabilities

Release Date: 27 Feb 2023

RISK: Medium Risk

TYPE: Clients - Browsers

TYPE: Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution and denial of service on the targeted system.


Impact

  • Denial of Service
  • Remote Code Execution

System / Technologies affected

  • Microsoft Edge prior to 110.0.1587.56

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

  • Update to version 110.0.1587.56 or later

Vulnerability Identifier


Source


Related Link

2023年2月24日星期五

思科產品多個漏洞

最後更新 2023年02月24日 16:00 發佈日期: 2023年02月24日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

類型: 保安軟件及應用設備

於 Cisco Systems Products 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發權限提升、遠端執行任意程式碼及洩露敏感資料。


影響

  • 權限提升
  • 遠端執行程式碼
  • 資料洩露

受影響之系統或技術

  • Cisco ESA
  • Cisco Secure Email and Web Manager
  • Firepower 4100 Series
  • Firepower 9300 Security Appliances
  • MDS 9000 Series Multilayer Switches (CSCwd18009)
  • Nexus 1000 Virtual Edge for VMware vSphere (CSCwd18012)
  • Nexus 1000V Switch for Microsoft Hyper-V (CSCwd18012)
  • Nexus 1000V Switch for VMware vSphere (CSCwd18012)
  • Nexus 3000 Series Switches (CSCwd00653)
  • Nexus 5500 Platform Switches (CSCwd18013)
  • Nexus 5600 Platform Switches (CSCwd18013)
  • Nexus 6000 Series Switches (CSCwd18013)
  • Nexus 7000 Series Switches (CSCwd18011)
  • Nexus 9000 Series Switches in standalone NX-OS mode (CSCwd00653)
  • UCS 6200 Series Fabric Interconnects
  • UCS 6300 Series Fabric Interconnects
  • UCS 6400 Series Fabric Interconnects
  • UCS 6500 Series Fabric Interconnects

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

Cisco Products Multiple Vulnerabilities

Last Update Date: 24 Feb 2023 16:00 Release Date: 24 Feb 2023

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

TYPE: Security Software & Appliance

Multiple vulnerabilities were identified in Cisco Systems Products. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.


Impact

  • Elevation of Privilege
  • Remote Code Execution
  • Information Disclosure

System / Technologies affected

  • Cisco ESA
  • Cisco Secure Email and Web Manager
  • Firepower 4100 Series
  • Firepower 9300 Security Appliances
  • MDS 9000 Series Multilayer Switches (CSCwd18009)
  • Nexus 1000 Virtual Edge for VMware vSphere (CSCwd18012)
  • Nexus 1000V Switch for Microsoft Hyper-V (CSCwd18012)
  • Nexus 1000V Switch for VMware vSphere (CSCwd18012)
  • Nexus 3000 Series Switches (CSCwd00653)
  • Nexus 5500 Platform Switches (CSCwd18013)
  • Nexus 5600 Platform Switches (CSCwd18013)
  • Nexus 6000 Series Switches (CSCwd18013)
  • Nexus 7000 Series Switches (CSCwd18011)
  • Nexus 9000 Series Switches in standalone NX-OS mode (CSCwd00653)
  • UCS 6200 Series Fabric Interconnects
  • UCS 6300 Series Fabric Interconnects
  • UCS 6400 Series Fabric Interconnects
  • UCS 6500 Series Fabric Interconnects

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

Google Chrome 多個漏洞

發佈日期: 2023年02月24日

風險: 中度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況,遠端執行程式碼。


影響

  • 遠端執行程式碼
  • 阻斷服務

受影響之系統或技術

  • Google Chrome 110.0.5481.177 (Linux) 之前的版本
  • Google Chrome 110.0.5481.177 (Mac) 之前的版本
  • Google Chrome 110.0.5481.177/.178 (Windows) 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝軟件供應商提供的修補程式:

  • 更新至 110.0.5481.177 (Linux) 或之後版本
  • 更新至 110.0.5481.177 (Mac) 或之後版本
  • 更新至 110.0.5481.177/.178 (Windows) 或之後版本

漏洞識別碼


資料來源


相關連結

Google Chrome Multiple Vulnerabilities

Release Date: 24 Feb 2023

RISK: Medium Risk

TYPE: Clients - Browsers

TYPE: Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and remote code execution on the targeted system.


Impact

  • Remote Code Execution
  • Denial of Service

System / Technologies affected

  • Google Chrome prior to 110.0.5481.177 (Linux)
  • Google Chrome prior to 110.0.5481.177 (Mac)
  • Google Chrome prior to 110.0.5481.177/.178 (Windows)

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

  • Update to version 110.0.5481.177 (Linux) or later
  • Update to version 110.0.5481.177 (Mac) or later
  • Update to version 110.0.5481.177/.178 (Windows) or later

Vulnerability Identifier


Source


Related Link

2023年2月23日星期四

Linux 內核多個漏洞

最後更新 2023年02月23日 發佈日期: 2023年02月13日

風險: 中度風險

類型: 操作系統 - LINUX

類型: LINUX

在 Linux 內核發現多個漏洞,遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼及洩露敏感資料。

 

[更新於 2023-02-15] 

更新受影響之系統或技術、解決方案、漏洞識別碼及相關連結。

 

[更新於 2023-02-17] 

更新相關連結。

 

[更新於 2023-02-20] 

更新受影響之系統或技術、漏洞識別碼及相關連結。

 

[更新於 2023-02-23] 

更新受影響之系統或技術、漏洞識別碼及相關連結。


影響

  • 阻斷服務
  • 資料洩露
  • 遠端執行程式碼
  • 權限提升

受影響之系統或技術

  • SUSE CaaS Platform 4.0
  • SUSE Enterprise Storage 7
  • SUSE Enterprise Storage 7.1
  • SUSE Linux Enterprise Desktop 15-SP4
  • SUSE Linux Enterprise High Availability 12-SP4
  • SUSE Linux Enterprise High Availability 15-SP1
  • SUSE Linux Enterprise High Availability 15-SP2
  • SUSE Linux Enterprise High Availability 15-SP3
  • SUSE Linux Enterprise High Availability 15-SP4
  • SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP3
  • SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS
  • SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP4
  • SUSE Linux Enterprise Live Patching 12-SP4
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro 5.3
  • SUSE Linux Enterprise Module for Basesystem 15-SP4
  • SUSE Linux Enterprise Module for Development Tools 15-SP4
  • SUSE Linux Enterprise Module for Legacy Software 15-SP4
  • SUSE Linux Enterprise Module for Live Patching 15-SP1
  • SUSE Linux Enterprise Module for Live Patching 15-SP2
  • SUSE Linux Enterprise Module for Live Patching 15-SP3
  • SUSE Linux Enterprise Module for Live Patching 15-SP4
  • SUSE Linux Enterprise Module for Public Cloud 15-SP4
  • SUSE Linux Enterprise Realtime Extension 15-SP3
  • SUSE Linux Enterprise Server 12-SP4-LTSS
  • SUSE Linux Enterprise Server 15-SP1-LTSS
  • SUSE Linux Enterprise Server 15-SP2-LTSS
  • SUSE Linux Enterprise Server 15-SP3
  • SUSE Linux Enterprise Server 15-SP3-LTSS
  • SUSE Linux Enterprise Server 15-SP4
  • SUSE Linux Enterprise Server for SAP 12-SP4
  • SUSE Linux Enterprise Server for SAP 15-SP1
  • SUSE Linux Enterprise Server for SAP 15-SP2
  • SUSE Linux Enterprise Server for SAP 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications
  • SUSE Linux Enterprise Server for SAP Applications 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications 15-SP4
  • SUSE Linux Enterprise Server
  • SUSE Linux Enterprise Workstation Extension 15-SP4
  • SUSE Manager Proxy 4.2
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.2
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.2
  • SUSE Manager Server 4.3
  • SUSE OpenStack Cloud 9
  • SUSE OpenStack Cloud Crowbar 9
  • openSUSE Leap 15.4
  • openSUSE Leap Micro 5.2
  • openSUSE Leap Micro 5.3
  • Ubuntu 16.04 ESM
  • Ubuntu 18.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 22.04 LTS
  • Ubuntu 22.10
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Real Time 8 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

對於 SUSE

安裝供應商提供的修補程式:

 

對於 Ubuntu

安裝供應商提供的修補程式:

 

對於 RedHat

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

Linux Kernel Multiple Vulnerabilities

Last Update Date: 23 Feb 2023 Release Date: 13 Feb 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

TYPE: Linux

Multiple vulnerabilities were identified in Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

 

[Updated on 2023-02-15] 

Updated System / Technologies affected, Solutions, Vulnerability Identifier and Related Links.

 

[Updated on 2023-02-17] 

Updated Related Links.

 

[Updated on 2023-02-20] 

Updated System / Technologies affected, Vulnerability Identifier and Related Links.

 

[Updated on 2023-02-23] 

Updated System / Technologies affected, Vulnerability Identifier and Related Links.


Impact

  • Denial of Service
  • Information Disclosure
  • Remote Code Execution
  • Elevation of Privilege

System / Technologies affected

  • SUSE CaaS Platform 4.0
  • SUSE Enterprise Storage 7
  • SUSE Enterprise Storage 7.1
  • SUSE Linux Enterprise Desktop 15-SP4
  • SUSE Linux Enterprise High Availability 12-SP4
  • SUSE Linux Enterprise High Availability 15-SP1
  • SUSE Linux Enterprise High Availability 15-SP2
  • SUSE Linux Enterprise High Availability 15-SP3
  • SUSE Linux Enterprise High Availability 15-SP4
  • SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP3
  • SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS
  • SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS
  • SUSE Linux Enterprise High Performance Computing 15-SP4
  • SUSE Linux Enterprise Live Patching 12-SP4
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro 5.3
  • SUSE Linux Enterprise Module for Basesystem 15-SP4
  • SUSE Linux Enterprise Module for Development Tools 15-SP4
  • SUSE Linux Enterprise Module for Legacy Software 15-SP4
  • SUSE Linux Enterprise Module for Live Patching 15-SP1
  • SUSE Linux Enterprise Module for Live Patching 15-SP2
  • SUSE Linux Enterprise Module for Live Patching 15-SP3
  • SUSE Linux Enterprise Module for Live Patching 15-SP4
  • SUSE Linux Enterprise Module for Public Cloud 15-SP4
  • SUSE Linux Enterprise Realtime Extension 15-SP3
  • SUSE Linux Enterprise Server 12-SP4-LTSS
  • SUSE Linux Enterprise Server 15-SP1-LTSS
  • SUSE Linux Enterprise Server 15-SP2-LTSS
  • SUSE Linux Enterprise Server 15-SP3
  • SUSE Linux Enterprise Server 15-SP3-LTSS
  • SUSE Linux Enterprise Server 15-SP4
  • SUSE Linux Enterprise Server for SAP 12-SP4
  • SUSE Linux Enterprise Server for SAP 15-SP1
  • SUSE Linux Enterprise Server for SAP 15-SP2
  • SUSE Linux Enterprise Server for SAP 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications
  • SUSE Linux Enterprise Server for SAP Applications 15-SP3
  • SUSE Linux Enterprise Server for SAP Applications 15-SP4
  • SUSE Linux Enterprise Server
  • SUSE Linux Enterprise Workstation Extension 15-SP4
  • SUSE Manager Proxy 4.2
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.2
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.2
  • SUSE Manager Server 4.3
  • SUSE OpenStack Cloud 9
  • SUSE OpenStack Cloud Crowbar 9
  • openSUSE Leap 15.4
  • openSUSE Leap Micro 5.2
  • openSUSE Leap Micro 5.3
  • Ubuntu 16.04 ESM
  • Ubuntu 18.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 22.04 LTS
  • Ubuntu 22.10
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Real Time 8 x86_64
  • Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
     

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

For SUSE

Apply fixes issued by the vendor:

 

For Ubuntu

Apply fixes issued by the vendor:

 

For RedHat

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

蘋果產品多個漏洞

最後更新 2023年02月23日 發佈日期: 2023年01月26日

風險: 極高度風險

類型: 操作系統 - 流動裝置及操作系統

類型: 流動裝置及操作系統

於蘋果產品發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料及繞過保安限制。

 

注意
CVE-2022-42856 漏洞正被廣泛利用。

 

[更新於 2023-02-23] 

更新漏洞識別碼。蘋果修訂了 iOS 16.3 和 iPadOS 16.3 的安全內容新增三個漏洞 (CVE-2023-23520, CVE-2023-23530, 及 CVE-2023-23531)


影響

  • 阻斷服務
  • 權限提升
  • 遠端執行程式碼
  • 資料洩露
  • 繞過保安限制

受影響之系統或技術

  • iOS 12.5.7 以前的版本
  • iOS 15.7.3 以前的版本
  • iOS 16.3 以前的版本
  • iPadOS 15.7.3 以前的版本
  • iPadOS 16.3 以前的版本
  • macOS Big Sur 11.7.3 以前的版本
  • macOS Monterey 12.6.3 以前的版本
  • macOS Ventura 13.2 以前的版本
  • Safari 16.3 以前的版本
  • tvOS 16.3 以前的版本
  • watchOS 9.3 以前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝供應商提供的修補程式:

 

  • iOS 12.5.7
  • iOS 15.7.3
  • iOS 16.3
  • iPadOS 15.7.3
  • iPadOS 16.3
  • macOS Big Sur 11.7.3
  • macOS Monterey 12.6.3
  • macOS Ventura 13.2
  • Safari 16.3
  • tvOS 16.3
  • watchOS 9.3

漏洞識別碼


資料來源


相關連結

Apple Products Multiple Vulnerabilities

Last Update Date: 23 Feb 2023 Release Date: 26 Jan 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

TYPE: Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

 

Note:
CVE-2022-42856 is being exploited in the wild.

 

[Updated on 2023-02-23] 

Updated Vulnerability Identifier. Apple revised the security content of iOS 16.3 and iPadOS 16.3 to include three new vulnerabilities (CVE-2023-23520, CVE-2023-23530, and CVE-2023-23531)


Impact

  • Denial of Service
  • Elevation of Privilege
  • Remote Code Execution
  • Information Disclosure
  • Security Restriction Bypass

System / Technologies affected

  • Version prior to iOS 12.5.7
  • Version prior to iOS 15.7.3
  • Version prior to iOS 16.3
  • Version prior to iPadOS 15.7.3
  • Version prior to iPadOS 16.3
  • Version prior to macOS Big Sur 11.7.3
  • Version prior to macOS Monterey 12.6.3
  • Version prior to macOS Ventura 13.2
  • Version prior to Safari 16.3
  • Version prior to tvOS 16.3
  • Version prior to watchOS 9.3

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

  • iOS 12.5.7
  • iOS 15.7.3
  • iOS 16.3
  • iPadOS 15.7.3
  • iPadOS 16.3
  • macOS Big Sur 11.7.3
  • macOS Monterey 12.6.3
  • macOS Ventura 13.2
  • Safari 16.3
  • tvOS 16.3
  • watchOS 9.3

Vulnerability Identifier


Source


Related Link

2023年2月22日星期三

Google Workspace Image
 
Verify that Tasks is turned ON for your organization prior to May 22, 2023, to ensure that Assistant and Calendar Reminders will be migrated for your users.
Dear Administrator, We’re writing to let you know that, as previously announcedGoogle Assistant and Calendar Reminders will be automatically migrated to Google Tasks starting May 22, 2023, if the Tasks service bit is ON. This migration will make it easier for users to manage their to-dos in one place, with Tasks featuring the same helpful functionality as Reminders. After the migration is complete, any data, excluding Keep reminders, that your organization has in the Assistant and Calendar Reminders service will no longer be accessible. If users, who didn't migrate, wish to keep a copy of their Assistant and Calendar Reminders data, they can use Google Takeout to download that data before June 22, 2023. After that date, Assistant and Calendar Reminders data will only be available in Tasks if it was migrated. Note: Reminders created in Keep will not be migrated. Reminders created in Keep will continue to be available in Keep.

What does this mean for my organization?

Any data, excluding Keep reminders, that your organization has in the Assistant and Calendar Reminders service will be automatically migrated to Google Tasks starting on May 22, 2023, provided that the Tasks service bit is ON. If the Tasks service bit is OFF, the Reminders data will not be migrated to Tasks and will only be accessible in Takeout until June 22, 2023. After June 22, 2023, the option to download Reminders data using Data Export for administrators or Google Takeout for users will no longer be available. Reminders data deletion will be initiated after June 22, 2023.

What do you need to do?

Verify the Tasks service bit is ON for your organization. If the Tasks service bit is OFF, your users will lose their Assistant and Calendar Reminders data unless you do one of the following before May 22, 2023: ● Turn Tasks ON, or ● Enable your organization to use Google Takeout and encourage your end users to export their Assistant and Calendar Reminders before the Reminders data deletion is initiated on June 22, 2023. If Calendar and Tasks are both enabled for your organization, in the coming weeks your users can click on a prompt within Google Calendar to voluntarily move their Reminders to Tasks before the automatic migration starts on May 22, 2023. If the Calendar service bit is OFF for your organization, users will not see a prompt in Calendar about the voluntary migration. We encourage you to turn Calendar ON or use an alternative form of messaging so that your users know the migration is happening. If your users want to use Assistant to manage their Tasks after the migration, you will need to ensure Search and Assistant is turned on for them. Once migrated, all migrated data will be accessible from Tasks either within Calendar, via Assistant, from the sidebar in Workspace, or from the dedicated Tasks apps.

We’re here to help

You can find answers to the most frequently asked questions in the help center. Thanks for choosing Google Workspace. – The Google Workspace Team

惡意軟件警報 - 零售商成為 Scattered Spider 黑客組織勒索軟件攻擊的目標

惡意軟件警報 - 零售商成為 Scattered Spider 黑客組織勒索軟件攻擊的目標 發佈日期: 2025年05月02日 類別: ...