2023年12月14日星期四

Microsoft Monthly Security Update (December 2023)

Release Date: 13 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Windows OS

TYPE: Windows OS

Microsoft has released monthly security update for their products:

 

Vulnerable ProductRisk LevelImpactsNotes
BrowserMedium Risk Medium RiskElevation of Privilege
Information Disclosure
 
WindowsMedium Risk Medium RiskElevation of Privilege
Information Disclosure
Remote Code Execution
Spoofing
Denial of Service
 
Microsoft DynamicsMedium Risk Medium RiskSpoofing
Denial of Service
 
Microsoft OfficeMedium Risk Medium RiskInformation Disclosure
Spoofing
 
Extended Security Updates (ESU)Medium Risk Medium RiskElevation of Privilege
Information Disclosure
Remote Code Execution
Spoofing
Denial of Service
 
AzureMedium Risk Medium RiskInformation Disclosure
Spoofing
Elevation of Privilege
 
System CenterMedium Risk Medium RiskDenial of Service 

 

Number of 'Extremely High Risk' product(s): 0

Number of 'High Risk' product(s): 0

Number of 'Medium Risk' product(s): 7

Number of 'Low Risk' product(s): 0

Evaluation of overall 'Risk Level': Medium Risk


Impact

  • Denial of Service
  • Elevation of Privilege
  • Remote Code Execution
  • Information Disclosure
  • Spoofing

System / Technologies affected

  • Browser
  • Windows
  • Microsoft Dynamics
  • Microsoft Office
  • Extended Security Updates (ESU)
  • Azure
  • System Center

Solutions

Before installation of the software, please visit the vendor web-site for more details.

  •  Apply fixes issued by the vendor.

Vulnerability Identifier


Source


Related Link

SUSE Linux 內核多個漏洞

發佈日期: 2023年12月13日

風險: 中度風險

類型: 操作系統 - LINUX

類型: LINUX

於 SUSE Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料及資料篡改。


影響

  • 阻斷服務
  • 遠端執行程式碼
  • 權限提升
  • 資料洩露
  • 篡改

受影響之系統或技術

  • Basesystem Module 15-SP5
  • Development Tools Module 15-SP5
  • Legacy Module 15-SP5
  • openSUSE Leap 15.4
  • openSUSE Leap 15.5
  • openSUSE Leap Micro 5.3
  • openSUSE Leap Micro 5.4
  • Public Cloud Module 15-SP5
  • SUSE Linux Enterprise Desktop 15 SP5
  • SUSE Linux Enterprise High Availability Extension 15 SP5
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise High Performance Computing 15 SP5
  • SUSE Linux Enterprise Live Patching 15-SP4
  • SUSE Linux Enterprise Live Patching 15-SP5
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro 5.3
  • SUSE Linux Enterprise Micro 5.4
  • SUSE Linux Enterprise Micro 5.5
  • SUSE Linux Enterprise Micro 6.0
  • SUSE Linux Enterprise Micro for Rancher 5.2
  • SUSE Linux Enterprise Micro for Rancher 5.3
  • SUSE Linux Enterprise Micro for Rancher 5.4
  • SUSE Linux Enterprise Real Time 12 SP5
  • SUSE Linux Enterprise Real Time 15 SP4
  • SUSE Linux Enterprise Real Time 15 SP5
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server 15 SP5
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP5
  • SUSE Linux Enterprise Workstation Extension 15 SP5
  • SUSE Real Time Module 15-SP4
  • SUSE Real Time Module 15-SP5

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

安裝供應商提供的修補程式:


漏洞識別碼


資料來源


相關連結

SUSE Linux Kernel Multiple Vulnerabilities

Release Date: 13 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

TYPE: Linux

Multiple vulnerabilities were identified in SUSE Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and data manipulation on the targeted system.


Impact

  • Denial of Service
  • Remote Code Execution
  • Elevation of Privilege
  • Information Disclosure
  • Data Manipulation

System / Technologies affected

  • Basesystem Module 15-SP5
  • Development Tools Module 15-SP5
  • Legacy Module 15-SP5
  • openSUSE Leap 15.4
  • openSUSE Leap 15.5
  • openSUSE Leap Micro 5.3
  • openSUSE Leap Micro 5.4
  • Public Cloud Module 15-SP5
  • SUSE Linux Enterprise Desktop 15 SP5
  • SUSE Linux Enterprise High Availability Extension 15 SP5
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise High Performance Computing 15 SP5
  • SUSE Linux Enterprise Live Patching 15-SP4
  • SUSE Linux Enterprise Live Patching 15-SP5
  • SUSE Linux Enterprise Micro 5.1
  • SUSE Linux Enterprise Micro 5.2
  • SUSE Linux Enterprise Micro 5.3
  • SUSE Linux Enterprise Micro 5.4
  • SUSE Linux Enterprise Micro 5.5
  • SUSE Linux Enterprise Micro 6.0
  • SUSE Linux Enterprise Micro for Rancher 5.2
  • SUSE Linux Enterprise Micro for Rancher 5.3
  • SUSE Linux Enterprise Micro for Rancher 5.4
  • SUSE Linux Enterprise Real Time 12 SP5
  • SUSE Linux Enterprise Real Time 15 SP4
  • SUSE Linux Enterprise Real Time 15 SP5
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server 15 SP5
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP5
  • SUSE Linux Enterprise Workstation Extension 15 SP5
  • SUSE Real Time Module 15-SP4
  • SUSE Real Time Module 15-SP5

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:


Vulnerability Identifier


Source


Related Link

2023年12月12日星期二

蘋果產品多個漏洞

發佈日期: 2023年12月12日

風險: 極高度風險

類型: 操作系統 - 流動裝置及操作系統

類型: 流動裝置及操作系統

於蘋果產品發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況、彷冒、遠端執行任意程式碼及資料洩露。

 

注意:

對於 CVE-2023-42916及CVE-2023-42917,處理網頁內容時可能導致任意代碼執行。蘋果知悉有報告指出,這個問題可能已在 iOS 16.7.1 之前的 iOS 版本中被廣泛利用。

 

影響

  • 遠端執行程式碼
  • 資料洩露
  • 仿冒
  • 阻斷服務

受影響之系統或技術

  • iOS 16.7.3 及 iPadOS 16.7.3 以前的版本
  • iOS 17.2 及 iPadOS 17.2 以前的版本
  • macOS Monterey 12.7.2 以前的版本
  • macOS Ventura 13.6.3 以前的版本
  • macOS Sonoma 14.2 以前的版本
  • Safari 17.2 以前的版本
  • tvOS 17.2 以前的版本
  • watchOS 10.2 以前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

安裝供應商提供的修補程式:

 

  • iOS 16.7.3 及 iPadOS 16.7.3
  • iOS 17.2 及 iPadOS 17.2
  • macOS Monterey 12.7.2
  • macOS Ventura 13.6.3
  • macOS Sonoma 14.2
  • Safari 17.2
  • tvOS 17.2
  • watchOS 10.2
 

漏洞識別碼


資料來源


相關連結

Apple Products Multiple Vulnerabilities

Release Date: 12 Dec 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

TYPE: Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing, remote code execution and information disclosure on the targeted system.

 

Note:

For CVE-2023-42916 and CVE-2023-42917, processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.1.


Impact

  • Remote Code Execution
  • Information Disclosure
  • Spoofing
  • Denial of Service

System / Technologies affected

  • Versions prior to iOS 16.7.3 and iPadOS 16.7.3
  • Versions prior to iOS 17.2 and iPadOS 17.2
  • Versions prior to macOS Monterey 12.7.2
  • Versions prior to macOS Ventura 13.6.3
  • Versions prior to macOS Sonoma 14.2
  • Versions prior to Safari 17.2
  • Versions prior to tvOS 17.2
  • Versions prior to watchOS 10.2

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

  • iOS 16.7.3 and iPadOS 16.7.3
  • iOS 17.2 and iPadOS 17.2
  • macOS Monterey 12.7.2
  • macOS Ventura 13.6.3
  • macOS Sonoma 14.2
  • Safari 17.2
  • tvOS 17.2
  • watchOS 10.2

Vulnerability Identifier


Source


Related Link

Apache Struts 遠端執行程式碼漏洞

發佈日期: 2023年12月11日

風險: 中度風險

類型: 伺服器 - 網站伺服器

類型: 網站伺服器

於 Apache Struts 發現一個漏洞。遠端使用者可利用此漏洞,於目標系統觸發遠端執行任意程式碼。


影響

  • 遠端執行程式碼

受影響之系統或技術

  • Struts 2.0.0 - Struts 2.3.37 (EOL)
  • Struts 2.5.0 - Struts 2.5.32
  • Struts 6.0.0 - Struts 6.3.0

解決方案

在安裝軟體之前,請先瀏覽軟體供應商之網站,以獲得更多詳細資料。

  • 更新至 Struts 2.5.33, Struts 6.3.0.2 或更高版本

漏洞識別碼


資料來源


相關連結

Apache Struts Remote Code Execution Vulnerability

Release Date: 11 Dec 2023

RISK: Medium Risk

TYPE: Servers - Web Servers

TYPE: Web Servers

A vulnerability has been identified in Apache Struts. A remote user can exploit this vulnerability to trigger remote code execution on the targeted system.


Impact

  • Remote Code Execution

System / Technologies affected

  • Struts 2.0.0 - Struts 2.3.37 (EOL)
  • Struts 2.5.0 - Struts 2.5.32
  • Struts 6.0.0 - Struts 6.3.0

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

  • Upgrade to Struts 2.5.33, Struts 6.3.0.2 or greater

Vulnerability Identifier


Source


Related Link

ChromeOS 多個漏洞

發佈日期: 2023年12月11日

風險: 中度風險

類型: 操作系統 - 其他操作系統

類型: 其他操作系統

於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。


影響

  • 遠端執行程式碼
  • 阻斷服務

受影響之系統或技術

  • 114.0.5735.343 (平台版本: 15437.81.0) 之前的版本

解決方案

在安裝軟體之前,請先瀏覽供應商之網站,以獲得更多詳細資料。

 

安裝供應商提供的修補程式,詳情請參閱以下連結:


漏洞識別碼


資料來源


相關連結

ChromeOS Multiple Vulnerabilities

Release Date: 11 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Others OS

TYPE: Others OS

Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and remote code execution on the targeted system.


Impact

  • Remote Code Execution
  • Denial of Service

System / Technologies affected

  • Version prior to 114.0.5735.343 (Platform Version: 15437.81.0)

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor. For detail, please refer to the link below:


Vulnerability Identifier


Source


Related Link

2023年12月9日星期六

Microsoft Edge 多個漏洞

發佈日期: 2023年12月08日

風險: 中度風險

類型: 用戶端 - 瀏覽器

類型: 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞,於目標系統觸發遠端阻斷服務狀況、權限提升、執行任意程式碼及敏感資料洩露。


Microsoft Edge Multiple Vulnerabilities

Release Date: 8 Dec 2023

RISK: Medium Risk

TYPE: Clients - Browsers

TYPE: Browsers

Multiple vulnerabilities were identified in Microsoft Edge.  A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.


WordPress 遠端執行程式碼漏洞

WordPress 遠端執行程式碼漏洞 發佈日期 : 2026 年 09 月 24 日 於 WordPress 發現一個漏洞。遠端攻擊者可利用這漏洞,於目標系統觸發遠端執行任意程式碼。   注意 : 針對 WordPress 新發現的漏洞 CVE-202...