SUSE Linux 內核多個漏洞

發佈日期: 2025年01月13日

風險: 中度風險

類型: 操作系統 - LINUX

於 SUSE Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料及繞過保安限制。

---

影響

• 遠端執行程式碼
• 阻斷服務
• 資料洩露
• 繞過保安限制
• 權限提升

---

受影響之系統或技術

• SUSE Linux Enterprise High Performance Computing 12 SP5
• SUSE Linux Enterprise Server 12 SP5
• SUSE Linux Enterprise Server 12 SP5 LTSS
• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
• SUSE Linux Enterprise Server for SAP Applications 12 SP5

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.suse.com/support/update/announcement/2025/suse-su-20250035-1/
• https://www.suse.com/support/update/announcement/2025/suse-su-20250034-1/

---

漏洞識別碼

• CVE-2021-46936
• CVE-2021-47162
• CVE-2021-47163
• CVE-2021-47416
• CVE-2021-47612
• CVE-2022-48788
• CVE-2022-48789
• CVE-2022-48790
• CVE-2022-48809
• CVE-2022-48853
• CVE-2022-48946
• CVE-2022-48949
• CVE-2022-48951
• CVE-2022-48956
• CVE-2022-48958
• CVE-2022-48960
• CVE-2022-48962
• CVE-2022-48966
• CVE-2022-48967
• CVE-2022-48969
• CVE-2022-48971
• CVE-2022-48972
• CVE-2022-48973
• CVE-2022-48978
• CVE-2022-48985
• CVE-2022-48988
• CVE-2022-48991
• CVE-2022-48992
• CVE-2022-48997
• CVE-2022-49000
• CVE-2022-49002
• CVE-2022-49010
• CVE-2022-49011
• CVE-2022-49014
• CVE-2022-49015
• CVE-2022-49020
• CVE-2022-49021
• CVE-2022-49026
• CVE-2022-49027
• CVE-2022-49028
• CVE-2022-49029
• CVE-2023-6270
• CVE-2023-46343
• CVE-2023-52881
• CVE-2023-52898
• CVE-2023-52918
• CVE-2023-52919
• CVE-2024-26801
• CVE-2024-26804
• CVE-2024-26852
• CVE-2024-26886
• CVE-2024-27043
• CVE-2024-27051
• CVE-2024-35937
• CVE-2024-36886
• CVE-2024-36905
• CVE-2024-36954
• CVE-2024-38538
• CVE-2024-39476
• CVE-2024-40965
• CVE-2024-41016
• CVE-2024-41082
• CVE-2024-42098
• CVE-2024-42114
• CVE-2024-42131
• CVE-2024-42145
• CVE-2024-42229
• CVE-2024-42253
• CVE-2024-44931
• CVE-2024-44958
• CVE-2024-44995
• CVE-2024-45016
• CVE-2024-46724
• CVE-2024-46755
• CVE-2024-46771
• CVE-2024-46777
• CVE-2024-46800
• CVE-2024-46802
• CVE-2024-46809
• CVE-2024-46813
• CVE-2024-46816
• CVE-2024-46818
• CVE-2024-46826
• CVE-2024-46834
• CVE-2024-46840
• CVE-2024-46841
• CVE-2024-46848
• CVE-2024-47660
• CVE-2024-47670
• CVE-2024-47672
• CVE-2024-47673
• CVE-2024-47674
• CVE-2024-47679
• CVE-2024-47684
• CVE-2024-47685
• CVE-2024-47696
• CVE-2024-47697
• CVE-2024-47698
• CVE-2024-47701
• CVE-2024-47706
• CVE-2024-47707
• CVE-2024-47713
• CVE-2024-47735
• CVE-2024-47737
• CVE-2024-47742
• CVE-2024-47745
• CVE-2024-47749
• CVE-2024-49851
• CVE-2024-49858
• CVE-2024-49860
• CVE-2024-49868
• CVE-2024-49877
• CVE-2024-49881
• CVE-2024-49882
• CVE-2024-49883
• CVE-2024-49884
• CVE-2024-49890
• CVE-2024-49891
• CVE-2024-49894
• CVE-2024-49896
• CVE-2024-49901
• CVE-2024-49920
• CVE-2024-49921
• CVE-2024-49925
• CVE-2024-49929
• CVE-2024-49936
• CVE-2024-49938
• CVE-2024-49945
• CVE-2024-49949
• CVE-2024-49950
• CVE-2024-49952
• CVE-2024-49957
• CVE-2024-49958
• CVE-2024-49959
• CVE-2024-49962
• CVE-2024-49965
• CVE-2024-49966
• CVE-2024-49967
• CVE-2024-49982
• CVE-2024-49991
• CVE-2024-49995
• CVE-2024-49996
• CVE-2024-50006
• CVE-2024-50007
• CVE-2024-50024
• CVE-2024-50033
• CVE-2024-50035
• CVE-2024-50044
• CVE-2024-50045
• CVE-2024-50047
• CVE-2024-50055
• CVE-2024-50058
• CVE-2024-50073
• CVE-2024-50074
• CVE-2024-50095
• CVE-2024-50099
• CVE-2024-50115
• CVE-2024-50117
• CVE-2024-50125
• CVE-2024-50135
• CVE-2024-50148
• CVE-2024-50150
• CVE-2024-50154
• CVE-2024-50167
• CVE-2024-50171
• CVE-2024-50179
• CVE-2024-50183
• CVE-2024-50187
• CVE-2024-50194
• CVE-2024-50195
• CVE-2024-50210
• CVE-2024-50218
• CVE-2024-50234
• CVE-2024-50236
• CVE-2024-50237
• CVE-2024-50264
• CVE-2024-50265
• CVE-2024-50267
• CVE-2024-50273
• CVE-2024-50278
• CVE-2024-50279
• CVE-2024-50289
• CVE-2024-50290
• CVE-2024-50296
• CVE-2024-50301
• CVE-2024-50302
• CVE-2024-53058
• CVE-2024-53061
• CVE-2024-53063
• CVE-2024-53066
• CVE-2024-53085
• CVE-2024-53088
• CVE-2024-53104
• CVE-2024-53114
• CVE-2024-53142

---

資料來源

• SUSE

---

相關連結

• https://www.suse.com/support/update/announcement/2025/suse-su-20250035-1/
• https://www.suse.com/support/update/announcement/2025/suse-su-20250034-1/

SUSE Linux Kernel Multiple Vulnerabilities

Release Date: 13 Jan 2025

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in SUSE Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

 

---

Impact

• Remote Code Execution
• Denial of Service
• Information Disclosure
• Security Restriction Bypass
• Elevation of Privilege

---

System / Technologies affected

• SUSE Linux Enterprise High Performance Computing 12 SP5
• SUSE Linux Enterprise Server 12 SP5
• SUSE Linux Enterprise Server 12 SP5 LTSS
• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
• SUSE Linux Enterprise Server for SAP Applications 12 SP5

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.suse.com/support/update/announcement/2025/suse-su-20250035-1/
• https://www.suse.com/support/update/announcement/2025/suse-su-20250034-1/

---

Vulnerability Identifier

• CVE-2021-46936
• CVE-2021-47162
• CVE-2021-47163
• CVE-2021-47416
• CVE-2021-47612
• CVE-2022-48788
• CVE-2022-48789
• CVE-2022-48790
• CVE-2022-48809
• CVE-2022-48853
• CVE-2022-48946
• CVE-2022-48949
• CVE-2022-48951
• CVE-2022-48956
• CVE-2022-48958
• CVE-2022-48960
• CVE-2022-48962
• CVE-2022-48966
• CVE-2022-48967
• CVE-2022-48969
• CVE-2022-48971
• CVE-2022-48972
• CVE-2022-48973
• CVE-2022-48978
• CVE-2022-48985
• CVE-2022-48988
• CVE-2022-48991
• CVE-2022-48992
• CVE-2022-48997
• CVE-2022-49000
• CVE-2022-49002
• CVE-2022-49010
• CVE-2022-49011
• CVE-2022-49014
• CVE-2022-49015
• CVE-2022-49020
• CVE-2022-49021
• CVE-2022-49026
• CVE-2022-49027
• CVE-2022-49028
• CVE-2022-49029
• CVE-2023-6270
• CVE-2023-46343
• CVE-2023-52881
• CVE-2023-52898
• CVE-2023-52918
• CVE-2023-52919
• CVE-2024-26801
• CVE-2024-26804
• CVE-2024-26852
• CVE-2024-26886
• CVE-2024-27043
• CVE-2024-27051
• CVE-2024-35937
• CVE-2024-36886
• CVE-2024-36905
• CVE-2024-36954
• CVE-2024-38538
• CVE-2024-39476
• CVE-2024-40965
• CVE-2024-41016
• CVE-2024-41082
• CVE-2024-42098
• CVE-2024-42114
• CVE-2024-42131
• CVE-2024-42145
• CVE-2024-42229
• CVE-2024-42253
• CVE-2024-44931
• CVE-2024-44958
• CVE-2024-44995
• CVE-2024-45016
• CVE-2024-46724
• CVE-2024-46755
• CVE-2024-46771
• CVE-2024-46777
• CVE-2024-46800
• CVE-2024-46802
• CVE-2024-46809
• CVE-2024-46813
• CVE-2024-46816
• CVE-2024-46818
• CVE-2024-46826
• CVE-2024-46834
• CVE-2024-46840
• CVE-2024-46841
• CVE-2024-46848
• CVE-2024-47660
• CVE-2024-47670
• CVE-2024-47672
• CVE-2024-47673
• CVE-2024-47674
• CVE-2024-47679
• CVE-2024-47684
• CVE-2024-47685
• CVE-2024-47696
• CVE-2024-47697
• CVE-2024-47698
• CVE-2024-47701
• CVE-2024-47706
• CVE-2024-47707
• CVE-2024-47713
• CVE-2024-47735
• CVE-2024-47737
• CVE-2024-47742
• CVE-2024-47745
• CVE-2024-47749
• CVE-2024-49851
• CVE-2024-49858
• CVE-2024-49860
• CVE-2024-49868
• CVE-2024-49877
• CVE-2024-49881
• CVE-2024-49882
• CVE-2024-49883
• CVE-2024-49884
• CVE-2024-49890
• CVE-2024-49891
• CVE-2024-49894
• CVE-2024-49896
• CVE-2024-49901
• CVE-2024-49920
• CVE-2024-49921
• CVE-2024-49925
• CVE-2024-49929
• CVE-2024-49936
• CVE-2024-49938
• CVE-2024-49945
• CVE-2024-49949
• CVE-2024-49950
• CVE-2024-49952
• CVE-2024-49957
• CVE-2024-49958
• CVE-2024-49959
• CVE-2024-49962
• CVE-2024-49965
• CVE-2024-49966
• CVE-2024-49967
• CVE-2024-49982
• CVE-2024-49991
• CVE-2024-49995
• CVE-2024-49996
• CVE-2024-50006
• CVE-2024-50007
• CVE-2024-50024
• CVE-2024-50033
• CVE-2024-50035
• CVE-2024-50044
• CVE-2024-50045
• CVE-2024-50047
• CVE-2024-50055
• CVE-2024-50058
• CVE-2024-50073
• CVE-2024-50074
• CVE-2024-50095
• CVE-2024-50099
• CVE-2024-50115
• CVE-2024-50117
• CVE-2024-50125
• CVE-2024-50135
• CVE-2024-50148
• CVE-2024-50150
• CVE-2024-50154
• CVE-2024-50167
• CVE-2024-50171
• CVE-2024-50179
• CVE-2024-50183
• CVE-2024-50187
• CVE-2024-50194
• CVE-2024-50195
• CVE-2024-50210
• CVE-2024-50218
• CVE-2024-50234
• CVE-2024-50236
• CVE-2024-50237
• CVE-2024-50264
• CVE-2024-50265
• CVE-2024-50267
• CVE-2024-50273
• CVE-2024-50278
• CVE-2024-50279
• CVE-2024-50289
• CVE-2024-50290
• CVE-2024-50296
• CVE-2024-50301
• CVE-2024-50302
• CVE-2024-53058
• CVE-2024-53061
• CVE-2024-53063
• CVE-2024-53066
• CVE-2024-53085
• CVE-2024-53088
• CVE-2024-53104
• CVE-2024-53114
• CVE-2024-53142

---

Source

• SUSE

---

Related Link

• https://www.suse.com/support/update/announcement/2025/suse-su-20250035-1/
• https://www.suse.com/support/update/announcement/2025/suse-su-20250034-1/

Juniper Junos OS 多個漏洞

發佈日期: 2025年01月10日

風險: 中度風險

類型: 操作系統 - Network

於 Juniper Junos OS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料、遠端執行程式碼、權限提升及繞過保安限制。

---

影響

• 阻斷服務
• 資料洩露
• 繞過保安限制
• 遠端執行程式碼
• 權限提升

---

受影響之系統或技術

• Junos OS
• Junos OS Evolved

詳情請參閱以下連結﹕

https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sort=%40sfcec_community_publish_date_formula__c%20descending&numberOfResults=25&f:ctype=[Security%20Advisories]

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

請參閱 2025-01 安全公告。

• https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sort=%40sfcec_community_publish_date_formula__c%20descending&numberOfResults=25&f:ctype=[Security%20Advisories]

---

漏洞識別碼

• CVE-2016-2183
• CVE-2020-11022
• CVE-2022-24805
• CVE-2022-24806
• CVE-2022-24807
• CVE-2022-24808
• CVE-2022-24809
• CVE-2022-24810
• CVE-2023-3019
• CVE-2023-3255
• CVE-2023-4408
• CVE-2023-5088
• CVE-2023-5517
• CVE-2023-5679
• CVE-2023-6240
• CVE-2023-6516
• CVE-2023-6683
• CVE-2023-7008
• CVE-2023-42467
• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-52463
• CVE-2023-52801
• CVE-2024-1488
• CVE-2024-6119
• CVE-2024-25742
• CVE-2024-25743
• CVE-2024-26629
• CVE-2024-26630
• CVE-2024-26720
• CVE-2024-26886
• CVE-2024-26946
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-32462
• CVE-2024-35791
• CVE-2024-35797
• CVE-2024-35875
• CVE-2024-36000
• CVE-2024-36019
• CVE-2024-36883
• CVE-2024-36979
• CVE-2024-38559
• CVE-2024-38619
• CVE-2024-39532
• CVE-2024-40927
• CVE-2024-40936
• CVE-2024-41040
• CVE-2024-41044
• CVE-2024-41055
• CVE-2024-41073
• CVE-2024-41096
• CVE-2024-42082
• CVE-2024-42096
• CVE-2024-42102
• CVE-2024-42131
• CVE-2024-45490
• CVE-2024-45491
• CVE-2024-45492
• CVE-2025-21592
• CVE-2025-21593
• CVE-2025-21596
• CVE-2025-21598
• CVE-2025-21599
• CVE-2025-21600
• CVE-2025-21602

---

資料來源

• Juniper Network

---

相關連結

• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specially-crafted-BGP-update-packet-causes-RPD-crash-CVE-2025-21602?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-certain-BGP-options-enabled-receipt-of-specifically-malformed-BGP-update-causes-RPD-crash-CVE-2025-21600?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-traceoptions-are-configured-receipt-of-malformed-BGP-packets-causes-RPD-to-crash-CVE-2025-21598?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX1500-SRX4100-SRX4200-Execution-of-low-privileged-CLI-command-results-in-chassisd-crash-CVE-2025-21596?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R2-release?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved-in-OpenSSH?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-Evolved-Receipt-of-specifically-malformed-IPv6-packets-causes-kernel-memory-exhaustion-leading-to-Denial-of-Service-CVE-2025-21599?language=en_US

Juniper Junos OS Multiple Vulnerabilities

Release Date: 10 Jan 2025

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

Multiple vulnerabilities were identified in Juniper Junos OS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure, remote code execution, elevation of privilege and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Information Disclosure
• Security Restriction Bypass
• Remote Code Execution
• Elevation of Privilege

---

System / Technologies affected

• Junos OS
• Junos OS Evolved

Please refer to the link below for detail:

https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sort=%40sfcec_community_publish_date_formula__c%20descending&numberOfResults=25&f:ctype=[Security%20Advisories]

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Please refer to 2025-01 Security Bulletin.

• https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sort=%40sfcec_community_publish_date_formula__c%20descending&numberOfResults=25&f:ctype=[Security%20Advisories]

---

Vulnerability Identifier

• CVE-2016-2183
• CVE-2020-11022
• CVE-2022-24805
• CVE-2022-24806
• CVE-2022-24807
• CVE-2022-24808
• CVE-2022-24809
• CVE-2022-24810
• CVE-2023-3019
• CVE-2023-3255
• CVE-2023-4408
• CVE-2023-5088
• CVE-2023-5517
• CVE-2023-5679
• CVE-2023-6240
• CVE-2023-6516
• CVE-2023-6683
• CVE-2023-7008
• CVE-2023-42467
• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-52463
• CVE-2023-52801
• CVE-2024-1488
• CVE-2024-6119
• CVE-2024-25742
• CVE-2024-25743
• CVE-2024-26629
• CVE-2024-26630
• CVE-2024-26720
• CVE-2024-26886
• CVE-2024-26946
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-32462
• CVE-2024-35791
• CVE-2024-35797
• CVE-2024-35875
• CVE-2024-36000
• CVE-2024-36019
• CVE-2024-36883
• CVE-2024-36979
• CVE-2024-38559
• CVE-2024-38619
• CVE-2024-39532
• CVE-2024-40927
• CVE-2024-40936
• CVE-2024-41040
• CVE-2024-41044
• CVE-2024-41055
• CVE-2024-41073
• CVE-2024-41096
• CVE-2024-42082
• CVE-2024-42096
• CVE-2024-42102
• CVE-2024-42131
• CVE-2024-45490
• CVE-2024-45491
• CVE-2024-45492
• CVE-2025-21592
• CVE-2025-21593
• CVE-2025-21596
• CVE-2025-21598
• CVE-2025-21599
• CVE-2025-21600
• CVE-2025-21602

---

Source

• Juniper Network

---

Related Link

• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-On-SRv6-enabled-devices-an-attacker-sending-a-malformed-BGP-update-can-cause-the-rpd-to-crash-CVE-2025-21593?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX-Series-Low-privileged-user-able-to-access-highly-sensitive-information-on-file-system-CVE-2025-21592?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Receipt-of-specially-crafted-BGP-update-packet-causes-RPD-crash-CVE-2025-21602?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-With-certain-BGP-options-enabled-receipt-of-specifically-malformed-BGP-update-causes-RPD-crash-CVE-2025-21600?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-When-BGP-traceoptions-are-configured-receipt-of-malformed-BGP-packets-causes-RPD-to-crash-CVE-2025-21598?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-SRX1500-SRX4100-SRX4200-Execution-of-low-privileged-CLI-command-results-in-chassisd-crash-CVE-2025-21596?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-24-1R2-release?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-Multiple-vulnerabilities-resolved-in-OpenSSH?language=en_US
• https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos-OS-Evolved-Receipt-of-specifically-malformed-IPv6-packets-causes-kernel-memory-exhaustion-leading-to-Denial-of-Service-CVE-2025-21599?language=en_US

GitLab 多個漏洞

發佈日期: 2025年01月10日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、繞過保安限制及敏感資料洩露。

---

影響

• 阻斷服務
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

• GitLab Community Edition (CE) 17.7.1, 17.6.3 及 17.5.5 以前的版本
• GitLab Enterprise Edition (EE) 17.7.1, 17.6.3 及 17.5.5 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/

---

漏洞識別碼

• CVE-2024-6324
• CVE-2024-12431
• CVE-2024-13041
• CVE-2025-0194

---

資料來源

• GitLab

---

相關連結

• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/

GitLab Multiple Vulnerabilities

Release Date: 10 Jan 2025

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit these vulnerabilities to trigger denial of service condition, security restriction bypass and sensitive information disclosure on the targeted system.

---

Impact

• Denial of Service
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• GitLab Community Edition (CE) versions prior to 17.7.1, 17.6.3 and 17.5.5
• GitLab Enterprise Edition (EE) versions prior to 17.7.1, 17.6.3 and 17.5.5

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/

---

Vulnerability Identifier

• CVE-2024-6324
• CVE-2024-12431
• CVE-2024-13041
• CVE-2025-0194

---

Source

• GitLab

---

Related Link

• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/

RedHat Linux 核心多個漏洞

發佈日期: 2025年01月10日

風險: 中度風險

類型: 操作系統 - LINUX

於 RedHat Linux核心發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、洩露敏感資料、阻斷服務狀況及權限提升。

 

---

影響

• 阻斷服務
• 遠端執行程式碼
• 資料洩露
• 權限提升

---

受影響之系統或技術

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.2 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Real Time 9 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 9 x86_64
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.4 x86_64
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.0 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.0 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

---

漏洞識別碼

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

---

資料來源

• Redhat

---

相關連結

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

RedHat Linux Kernel Multiple Vulnerabilities

Release Date: 10 Jan 2025

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in RedHat Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, sensitive information disclosure, denial of service condition and elevation of privilege on the targeted system.

 

---

Impact

• Denial of Service
• Remote Code Execution
• Information Disclosure
• Elevation of Privilege

---

System / Technologies affected

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.2 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat Enterprise Linux Server - AUS 9.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.2 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.2 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.2 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Real Time 9 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 9 x86_64
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.4 x86_64
• Red Hat Enterprise Linux for Real Time for x86_64 - 4 years of updates 9.0 x86_64
• Red Hat Enterprise Linux for Real Time for NFV for x86_64 - 4 years of updates 9.0 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

---

Vulnerability Identifier

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

---

Source

• Redhat

---

Related Link

• https://access.redhat.com/errata/RHSA-2025:0109
• https://access.redhat.com/errata/RHSA-2025:0067
• https://access.redhat.com/errata/RHSA-2025:0065
• https://access.redhat.com/errata/RHSA-2025:0064
• https://access.redhat.com/errata/RHSA-2025:0063
• https://access.redhat.com/errata/RHSA-2025:0062
• https://access.redhat.com/errata/RHSA-2025:0061
• https://access.redhat.com/errata/RHSA-2025:0060
• https://access.redhat.com/errata/RHSA-2025:0059
• https://access.redhat.com/errata/RHSA-2025:0058
• https://access.redhat.com/errata/RHSA-2025:0057
• https://access.redhat.com/errata/RHSA-2025:0056
• https://access.redhat.com/errata/RHSA-2025:0055
• https://access.redhat.com/errata/RHSA-2025:0054
• https://access.redhat.com/errata/RHSA-2025:0053
• https://access.redhat.com/errata/RHSA-2025:0052
• https://access.redhat.com/errata/RHSA-2025:0051
• https://access.redhat.com/errata/RHSA-2025:0050
• https://access.redhat.com/errata/RHSA-2025:0049

Ivanti 產品多個漏洞

發佈日期: 2025年01月09日

風險: 極高度風險

類型: 操作系統 - Network

於 Ivanti 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼及權限提升。

 

注意：

CVE-2025-0282 正在被廣泛利用。 該漏洞可以導致在目標裝置上遠端執行程式碼。

---

影響

• 遠端執行程式碼
• 權限提升

---

受影響之系統或技術

CVE-2025-0282:

 

• Ivanti Connect Secure (ICS) 版本 22.7R2 至 22.7R2.4版本
• Ivanti Policy Secure (IPS) 版本 22.7R1 至 22.7R1.2版本
• Ivanti Neurons for ZTA gateways 版本 22.7R2 至 22.7R2.3版本

 

CVE-2025-0283:

 

• Ivanti Connect Secure (ICS) 版本 22.7R2.4 及更早版本、版本 9.1R18.9 及更早版本
• Ivanti Policy Secure (IPS) 版本 22.7R1.2 及更早版本
• Ivanti Neurons for ZTA gateways 版本 22.7R2.3 及更早版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US

---

漏洞識別碼

• CVE-2025-0282
• CVE-2025-0283

---

資料來源

• Ivanti

---

相關連結

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US