2023年3月3日星期五

SUSE Linux Kernel Multiple Vulnerabilities

Last Update Date: 3 Mar 2023 Release Date: 2 Mar 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

TYPE: Linux

Multiple vulnerabilities were identified in SUSE Linux. An attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

 

[Updated on 2023-03-03] 

Updated Impact, System / Technologies affected, Solutions, Vulnerability Identifier and Related Links.

Impact

  • Denial of Service
  • Elevation of Privilege
  • Remote Code Execution
  • Information Disclosure

System / Technologies affected

  • SUSE Linux Enterprise High Performance Computing 12 SP4
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise High Performance Computing 15 SP1
  • SUSE Linux Enterprise High Performance Computing 15 SP2
  • SUSE Linux Enterprise High Performance Computing 15 SP3
  • SUSE Linux Enterprise Live Patching 12-SP4
  • SUSE Linux Enterprise Live Patching 12-SP5
  • SUSE Linux Enterprise Live Patching 15-SP1
  • SUSE Linux Enterprise Live Patching 15-SP2
  • SUSE Linux Enterprise Live Patching 15-SP3
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro for Rancher 5.2
  • SUSE Linux Enterprise Real Time 15 SP3
  • SUSE Linux Enterprise Server 12 SP4
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server 15 SP1
  • SUSE Linux Enterprise Server 15 SP2
  • SUSE Linux Enterprise Server 15 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP4
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
  • SUSE Linux Enterprise Server for SAP Applications 15 SP1
  • SUSE Linux Enterprise Server for SAP Applications 15 SP2
  • SUSE Linux Enterprise Server for SAP Applications 15 SP3
  • SUSE Real Time Module 15-SP3

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Related Link

於 沒有留言:

IBM WebSphere Application Server 多個漏洞

發佈日期: 2023年03月02日

風險: 中度風險

類型: 伺服器 - 互聯網應用伺服器

類型: 互聯網應用伺服器

於 IBM WebSphere Application Server 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行程式碼及跨網站指令碼。

影響

  • 遠端執行程式碼
  • 跨網站指令碼

受影響之系統或技術

  • IBM WebSphere Application Server 版本 8.5
  • IBM Planning Analytics Local 版本 2.0
  • IBM Planning Analytics Workspace 版本 2.0

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

漏洞識別碼

資料來源

相關連結

於 沒有留言:

IBM WebSphere Application Server Multiple Vulnerabilities

Release Date: 2 Mar 2023

RISK: Medium Risk

TYPE: Servers - Internet App Servers

TYPE: Internet App Servers

Multiple vulnerabilities were identified in IBM WebSphere Application Server. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution and cross-site scripting on the targeted system.

Impact

  • Remote Code Execution
  • Cross-Site Scripting

System / Technologies affected

  • IBM WebSphere Application Server 8.5
  • IBM Planning Analytics Local 2.0
  • IBM Planning Analytics Workspace 2.0

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Related Link

於 沒有留言:

Mozilla Firefox 遠端執行任意程式碼漏洞

發佈日期: 2023年03月01日

風險: 中度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器
於 Mozilla Firefox 發現一個漏洞，遠端攻擊者可利用這漏洞，於目標系統遠端執行任意程式碼。

影響

  • 遠端執行程式碼

受影響之系統或技術

以下版本之前的版本﹕

  • Firefox for Android 110.1

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

  •  Firefox for Android 110.1

漏洞識別碼

資料來源

相關連結

於 沒有留言:

Mozilla Firefox Remote Code Execution Vulnerability

Release Date: 1 Mar 2023

RISK: Medium Risk

TYPE: Clients - Browsers

TYPE: Browsers
A vulnerability was identified in Mozilla Firefox, a remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

Impact

  • Remote Code Execution

System / Technologies affected

Versions prior to:

  • Firefox for Android 110.1

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

  • Firefox for Android 110.1

Vulnerability Identifier

Source

Related Link

於 沒有留言:

Aruba 產品多個漏洞

發佈日期: 2023年03月01日

風險: 高度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

類型: 保安軟件及應用設備

在Aruba產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、洩露敏感資料、跨網站指令碼及繞過保安限制。

影響

  • 遠端執行程式碼
  • 繞過保安限制
  • 資料洩露
  • 跨網站指令碼

受影響之系統或技術

  • Aruba Mobility Conductor (formerly Mobility Master)
  • Aruba Mobility Controllers
  • WLAN Gateways and SD-WAN Gateways managed by Aruba Central

受影響的軟件版本

  • ArubaOS 8.6.0.19 and below
  • ArubaOS 8.10.0.4 and below
  • ArubaOS 10.3.1.0 and below
  • SD-WAN 8.7.0.0-2.3.0.8 and below

修補程式不包括已終止支援的產品，以下已終止支援的 ArubaOS 和 SD-WAN 軟件版本會受這些漏洞的影響

  • ArubaOS 6.5.4.x
  • ArubaOS 8.7.x.x
  • ArubaOS 8.8.x.x
  • ArubaOS 8.9.x.x
  • SD-WAN 8.6.0.4-2.2.x.x

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

漏洞識別碼

資料來源

相關連結

於 沒有留言:

Aruba Products Multiple Vulnerabilities

Release Date: 1 Mar 2023

RISK: High Risk

TYPE: Security software and application - Security Software & Appliance

TYPE: Security Software & Appliance

Multiple vulnerabilities were identified in Aruba Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, sensitive information disclosure, cross-site scripting and security restriction bypass on the targeted system.

Impact

  • Remote Code Execution
  • Security Restriction Bypass
  • Information Disclosure
  • Cross-Site Scripting

System / Technologies affected

  • Aruba Mobility Conductor (formerly Mobility Master)
  • Aruba Mobility Controllers
  • WLAN Gateways and SD-WAN Gateways managed by Aruba Central

Affected Software Versions

  • ArubaOS 8.6.0.19 and below
  • ArubaOS 8.10.0.4 and below
  • ArubaOS 10.3.1.0 and below
  • SD-WAN 8.7.0.0-2.3.0.8 and below

The following ArubaOS and SD-WAN software versions that are End of Life are affected by these vulnerabilities and are not patched by this advisory

  • ArubaOS 6.5.4.x
  • ArubaOS 8.7.x.x
  • ArubaOS 8.8.x.x
  • ArubaOS 8.9.x.x
  • SD-WAN 8.6.0.4-2.2.x.x

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Related Link

於 沒有留言:

RedHat Linux 核心多個漏洞

發佈日期: 2023年03月01日

風險: 中度風險

類型: 操作系統 - LINUX

類型: LINUX

在 RedHat Linux 核心發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及權限提升。

影響

  • 阻斷服務
  • 權限提升

受影響之系統或技術

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux Server - AUS 7.7 x86_64
  • Red Hat Enterprise Linux Server - TUS 7.7 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64

 

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

漏洞識別碼

資料來源

相關連結

於 沒有留言:

RedHat Linux Kernel Multiple Vulnerabilities

Release Date: 1 Mar 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

TYPE: Linux

Multiple vulnerabilities were identified in RedHat Linux Kernal. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and elevation of privilege on the targeted system.

Impact

  • Denial of Service
  • Elevation of Privilege

System / Technologies affected

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 9 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux Server - AUS 7.7 x86_64
  • Red Hat Enterprise Linux Server - TUS 7.7 x86_64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64

 

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

Vulnerability Identifier

Source

Related Link

於 沒有留言:

甲骨文產品多個漏洞

最後更新 2023年03月01日 發佈日期: 2023年01月18日

風險: 高度風險

類型: 伺服器 - 數據庫伺服器

類型: 數據庫伺服器

於甲骨文產品發現多個漏洞，遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行程式碼、繞過保安限制、洩露敏感資料及資料篡改。

 

[更新於 2023-03-01] 

更新受影響之系統或技術。

 

注意：

CVE-2023-21839的概念驗證碼已被公開，影響 WebLogic Server。風險程度由中度風險更改至高度風險。

 

影響

  • 阻斷服務
  • 遠端執行程式碼
  • 繞過保安限制
  • 資料洩露
  • 篡改

受影響之系統或技術

  • Oracle MySQL
  • Java SE
  • Oracle Database Server
  • WebLogic Server
  • VirtualBox

 

有關其他 甲骨文 產品，請參閱以下連結:

https://www.oracle.com/security-alerts/cpujan2023.html

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

https://www.oracle.com/security-alerts/cpujan2023.html

漏洞識別碼

資料來源

相關連結

於 沒有留言:

Oracle Products Multiple Vulnerabilities

Last Update Date: 1 Mar 2023 Release Date: 18 Jan 2023

RISK: High Risk

TYPE: Servers - Database Servers

TYPE: Database Servers

Multiple vulnerabilities were identified in Oracle Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, security restriction bypass, sensitive information disclosure and data manipulation on the targeted system.

 

[Updated on 2023-03-01] 

Updated System / Technologies affected.

 

Note:

Proof Of Concept Exploit Code is Publicly Available for CVE-2023-21839, affecting WebLogic Server. Risk level has changed from Medium Risk to High Risk.

Impact

  • Denial of Service
  • Remote Code Execution
  • Security Restriction Bypass
  • Information Disclosure
  • Data Manipulation

System / Technologies affected

  • Oracle MySQL
  • Java SE
  • Oracle Database Server
  • WebLogic Server
  • VirtualBox

 

For other Oracle products, please refer to the link below:

https://www.oracle.com/security-alerts/cpujan2023.html

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

https://www.oracle.com/security-alerts/cpujan2023.html

Vulnerability Identifier

Source

Related Link

於 沒有留言:
訂閱： 文章 (Atom)

WordPress 多個漏洞

WordPress 多個漏洞 發佈日期 : 2026 年 09 月 22 日 於 WordPress 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼、繞過保安限制、敏感資料洩露、遠端執行任意程式碼及資料篡改。   注意 : 針對 Word...

  • (沒有標題)
    RedHat Linux Kernel Multiple Vulnerabilities Release Date: 4 Sep 2024 RIS...
  • (沒有標題)
    Juniper Junos OS Multiple Vulnerabilities Release Date: 12 Jul 2024 RISK:...