Ubuntu Linux Kernel Multiple Vulnerabilities

Release Date: 10 Jun 2022

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities have been identified in Ubuntu Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service, elevation of privilege, remote code execution, security restriction bypass and information disclosure on the targeted system.

---

Impact

• Denial of Service
• Elevation of Privilege
• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• Ubuntu 14.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 18.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 21.10
• Ubuntu 22.04 LTS

 

Please refer to the links below for detail:

 

• https://ubuntu.com/security/notices/USN-5465-1
• https://ubuntu.com/security/notices/USN-5466-1
• https://ubuntu.com/security/notices/USN-5467-1
• https://ubuntu.com/security/notices/USN-5468-1
• https://ubuntu.com/security/notices/USN-5469-1
• https://ubuntu.com/security/notices/USN-5470-1
• https://ubuntu.com/security/notices/USN-5471-1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

 

• https://ubuntu.com/security/notices/USN-5465-1
• https://ubuntu.com/security/notices/USN-5466-1
• https://ubuntu.com/security/notices/USN-5467-1
• https://ubuntu.com/security/notices/USN-5468-1
• https://ubuntu.com/security/notices/USN-5469-1
• https://ubuntu.com/security/notices/USN-5470-1
• https://ubuntu.com/security/notices/USN-5471-1

---

Vulnerability Identifier

• CVE-2021-3772
• CVE-2021-4149
• CVE-2021-4197
• CVE-2022-0168
• CVE-2022-1011
• CVE-2022-1012
• CVE-2022-1016
• CVE-2022-1048
• CVE-2022-1158
• CVE-2022-1195
• CVE-2022-1198
• CVE-2022-1199
• CVE-2022-1204
• CVE-2022-1205
• CVE-2022-1263
• CVE-2022-1353
• CVE-2022-1419
• CVE-2022-1516
• CVE-2022-1651
• CVE-2022-1671
• CVE-2022-1734
• CVE-2022-1836
• CVE-2022-1966
• CVE-2022-1972
• CVE-2022-21499
• CVE-2022-23036
• CVE-2022-23037
• CVE-2022-23038
• CVE-2022-23039
• CVE-2022-23040
• CVE-2022-23041
• CVE-2022-23042
• CVE-2022-24958
• CVE-2022-26966
• CVE-2022-28356
• CVE-2022-28388
• CVE-2022-28389
• CVE-2022-28390
• CVE-2022-29968
• CVE-2022-30594

---

Source

• Ubuntu
• AusCERT

---

Related Link

• https://ubuntu.com/security/notices/USN-5465-1
• https://ubuntu.com/security/notices/USN-5466-1
• https://ubuntu.com/security/notices/USN-5467-1
• https://ubuntu.com/security/notices/USN-5468-1
• https://ubuntu.com/security/notices/USN-5469-1
• https://ubuntu.com/security/notices/USN-5470-1
• https://ubuntu.com/security/notices/USN-5471-1
• https://www.auscert.org.au/bulletins/ESB-2022.2839
• https://www.auscert.org.au/bulletins/ESB-2022.2840
• https://www.auscert.org.au/bulletins/ESB-2022.2841
• https://www.auscert.org.au/bulletins/ESB-2022.2842
• https://www.auscert.org.au/bulletins/ESB-2022.2843
• https://www.auscert.org.au/bulletins/ESB-2022.2844
• https://www.auscert.org.au/bulletins/ESB-2022.2845

Fortinet 產品多個漏洞

發佈日期: 2022年06月09日

風險: 中度風險

類型: 操作系統 - Network

於 Fortinet 產品發現多個漏洞，遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、洩露敏感資料、仿冒及跨網站指令碼。

---

影響

• 遠端執行程式碼
• 資料洩露
• 仿冒
• 跨網站指令碼

---

受影響之系統或技術

• FortiAnalyzer 7.0.2 及之前的版本
• FortiAnalyzer 6.4.7 及之前的版本
• FortiAP-U 6.2.0 至 6.2.3 版本
• FortiAP-U 6.0.0 至 6.0.4 版本
• FortiAP-U 5.4.0 至 5.4.6 版本
• FortiAuthenticator Agent for Microsoft OWA 2.1 版本
• FortiAuthenticator Agent for Microsoft OWA 2.2 版本
• FortiClientWindows 6.0.0 至 6.0.10 版本
• FortiClientWindows 6.2.0 至 6.2.9 版本
• FortiClientWindows 6.4.0 至 6.4.7 版本
• FortiClientWindows 7.0.0 至 7.0.3 版本
• FortiDDoS 5.5.0 至 5.5.1 版本
• FortiDDoS 5.4.0 至 5.4.2 版本
• FortiDDoS 5.3.0 至 5.3.1 版本
• FortiDDoS 5.2.0 版本
• FortiDDoS 5.1.0 版本
• FortiOS 6.2.x 版本
• FortiOS 6.0.x 版本
• FortiManager 7.0.1 及之前的版本
• FortiManager 6.4.6 及之前的版本
• FortiSandbox 4.0.x 版本
• FortiSandbox 3.2.x 版本
• FortiSandbox 3.1.5 及之前的版本
• FortiTokenMobile for Android v5.0.3 及之前的版本
• FortiTokenMobile for iOS v5.2.0 及之前的版本
• FortiTokenMobile for Windows v4.0.3 及之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

• 安裝供應商提供的修補程式：
  https://fortiguard.fortinet.com/psirt/FG-IR-18-292
  https://fortiguard.fortinet.com/psirt/FG-IR-21-024
  https://fortiguard.fortinet.com/psirt/FG-IR-22-021
  https://fortiguard.fortinet.com/psirt/FG-IR-22-044
  https://fortiguard.fortinet.com/psirt/FG-IR-22-071
  https://fortiguard.fortinet.com/psirt/FG-IR-22-109

---

漏洞識別碼

• CVE-2021-22131
• CVE-2022-22304
• CVE-2022-22305
• CVE-2022-26113
• CVE-2022-29060
• CVE-2022-30301

---

資料來源

• Fortinet

---

相關連結

• https://fortiguard.fortinet.com/psirt/FG-IR-18-292
• https://fortiguard.fortinet.com/psirt/FG-IR-21-024
• https://fortiguard.fortinet.com/psirt/FG-IR-22-021
• https://fortiguard.fortinet.com/psirt/FG-IR-22-044
• https://fortiguard.fortinet.com/psirt/FG-IR-22-071
• https://fortiguard.fortinet.com/psirt/FG-IR-22-109

Fortinet Products Multiple Vulnerabilities

Release Date: 9 Jun 2022

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

Multiple vulnerabilities were identified in Fortinet Products, a remote attacker could exploit some of these vulnerabilities to trigger remote code execution, sensitive information disclosure, spoofing and cross-site scripting on the targeted system.

---

Impact

• Remote Code Execution
• Information Disclosure
• Spoofing
• Cross-Site Scripting

---

System / Technologies affected

• FortiAnalyzer 7.0.2 and prior versions
• FortiAnalyzer 6.4.7 and prior versions
• FortiAP-U versions 6.2.0 to 6.2.3
• FortiAP-U versions 6.0.0 to 6.0.4
• FortiAP-U versions 5.4.0 to 5.4.6
• FortiAuthenticator Agent for Microsoft OWA version 2.1
• FortiAuthenticator Agent for Microsoft OWA version 2.2
• FortiClientWindows versions 6.0.0 to 6.0.10
• FortiClientWindows versions 6.2.0 to 6.2.9
• FortiClientWindows versions 6.4.0 to 6.4.7
• FortiClientWindows versions 7.0.0 to 7.0.3
• FortiDDoS versions 5.5.0 to 5.5.1
• FortiDDoS versions 5.4.0 to 5.4.2
• FortiDDoS versions 5.3.0 to 5.3.1
• FortiDDoS version 5.2.0
• FortiDDoS version 5.1.0
• FortiOS versions 6.2.x
• FortiOS versions 6.0.x
• FortiManager 7.0.1 and prior versions
• FortiManager 6.4.6 and prior versions
• FortiSandbox versions 4.0.x
• FortiSandbox versions 3.2.x
• FortiSandbox 3.1.5 and prior versions
• FortiTokenMobile for Android v5.0.3 and prior versions
• FortiTokenMobile for iOS v5.2.0 and prior versions
• FortiTokenMobile for Windows v4.0.3 and prior versions

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

• Apply fixes issued by the vendor:
  https://fortiguard.fortinet.com/psirt/FG-IR-18-292
  https://fortiguard.fortinet.com/psirt/FG-IR-21-024
  https://fortiguard.fortinet.com/psirt/FG-IR-22-021
  https://fortiguard.fortinet.com/psirt/FG-IR-22-044
  https://fortiguard.fortinet.com/psirt/FG-IR-22-071
  https://fortiguard.fortinet.com/psirt/FG-IR-22-109

---

Vulnerability Identifier

• CVE-2021-22131
• CVE-2022-22304
• CVE-2022-22305
• CVE-2022-26113
• CVE-2022-29060
• CVE-2022-30301

---

Source

• Fortinet

---

Related Link

• https://fortiguard.fortinet.com/psirt/FG-IR-18-292
• https://fortiguard.fortinet.com/psirt/FG-IR-21-024
• https://fortiguard.fortinet.com/psirt/FG-IR-22-021
• https://fortiguard.fortinet.com/psirt/FG-IR-22-044
• https://fortiguard.fortinet.com/psirt/FG-IR-22-071
• https://fortiguard.fortinet.com/psirt/FG-IR-22-109

Android多個漏洞

發佈日期: 2022年06月08日

風險: 中度風險

類型: 操作系統 - 流動裝置及操作系統

於 Android 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發資料洩露、權限提升、遠端執行程式碼及阻斷服務狀況。

---

影響

• 權限提升
• 資料洩露
• 阻斷服務
• 遠端執行程式碼

---

受影響之系統或技術

• 2022-06-05 前的 Android 保安更新級別

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 安裝軟件供應商提供的修補程式：
  https://source.android.com/security/bulletin/2022-06-01

---

漏洞識別碼

• CVE-2021-4154
• CVE-2021-35083
• CVE-2021-35102
• CVE-2021-35111
• CVE-2021-39624
• CVE-2021-39691
• CVE-2022-20006
• CVE-2022-20123
• CVE-2022-20124
• CVE-2022-20125
• CVE-2022-20126
• CVE-2022-20127
• CVE-2022-20129
• CVE-2022-20130
• CVE-2022-20131
• CVE-2022-20132
• CVE-2022-20133
• CVE-2022-20134
• CVE-2022-20135
• CVE-2022-20136
• CVE-2022-20137
• CVE-2022-20138
• CVE-2022-20140
• CVE-2022-20141
• CVE-2022-20142
• CVE-2022-20143
• CVE-2022-20144
• CVE-2022-20145
• CVE-2022-20147
• CVE-2022-20210
• CVE-2022-21745
• CVE-2022-22082
• CVE-2022-22083
• CVE-2022-22084
• CVE-2022-22085
• CVE-2022-22086
• CVE-2022-22087
• CVE-2022-22090
• CVE-2022-24958
• CVE-2022-25258

---

資料來源

• AusCERT
• Android

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.2804
• https://source.android.com/security/bulletin/2022-06-01

Android Multiple Vulnerabilities

Release Date: 8 Jun 2022

RISK: Medium Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger information disclosure, elevation of privilege, remote code execution and denial of service condition on the targeted system.

---

Impact

• Elevation of Privilege
• Information Disclosure
• Denial of Service
• Remote Code Execution

---

System / Technologies affected

• Android security patch level prior to 2022-06-05

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor:
  https://source.android.com/security/bulletin/2022-06-01

---

Vulnerability Identifier

• CVE-2021-4154
• CVE-2021-35083
• CVE-2021-35102
• CVE-2021-35111
• CVE-2021-39624
• CVE-2021-39691
• CVE-2022-20006
• CVE-2022-20123
• CVE-2022-20124
• CVE-2022-20125
• CVE-2022-20126
• CVE-2022-20127
• CVE-2022-20129
• CVE-2022-20130
• CVE-2022-20131
• CVE-2022-20132
• CVE-2022-20133
• CVE-2022-20134
• CVE-2022-20135
• CVE-2022-20136
• CVE-2022-20137
• CVE-2022-20138
• CVE-2022-20140
• CVE-2022-20141
• CVE-2022-20142
• CVE-2022-20143
• CVE-2022-20144
• CVE-2022-20145
• CVE-2022-20147
• CVE-2022-20210
• CVE-2022-21745
• CVE-2022-22082
• CVE-2022-22083
• CVE-2022-22084
• CVE-2022-22085
• CVE-2022-22086
• CVE-2022-22087
• CVE-2022-22090
• CVE-2022-24958
• CVE-2022-25258

---

Source

• AusCERT
• Android

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.2804
• https://source.android.com/security/bulletin/2022-06-01

SUSE Linux 內核多個漏洞

最後更新 2022年06月07日 發佈日期: 2022年06月06日

風險: 中度風險

類型: 操作系統 - LINUX

於 SUSE Products 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升及繞過保安限制。

 

[更新於 2022-06-07]

更新受影響之系統或技術，解決方案及相關連結。

---

影響

• 權限提升
• 繞過保安限制

---

受影響之系統或技術

• SUSE Linux Enterprise High Performance Computing 15
• SUSE Linux Enterprise High Performance Computing 15-SP1
• SUSE Linux Enterprise High Performance Computing 15-SP2
• SUSE Linux Enterprise High Performance Computing 15-SP3
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Micro 5.1
• SUSE Linux Enterprise Module for Live Patching 15
• SUSE Linux Enterprise Module for Live Patching 15-SP1
• SUSE Linux Enterprise Module for Live Patching 15-SP2
• SUSE Linux Enterprise Module for Live Patching 15-SP3
• SUSE Linux Enterprise Server 15
• SUSE Linux Enterprise Server 15-SP1
• SUSE Linux Enterprise Server 15-SP2
• SUSE Linux Enterprise Server 15-SP3
• SUSE Linux Enterprise Server for SAP Applications 15
• SUSE Linux Enterprise Server for SAP Applications 15-SP1
• SUSE Linux Enterprise Server for SAP Applications 15-SP2
• SUSE Linux Enterprise Server for SAP Applications 15-SP3

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.suse.com/support/update/announcement/2022/suse-su-20222000-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221988-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221974-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221955-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221949-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221948-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221947-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

---

漏洞識別碼

• CVE-2022-1048
• CVE-2022-30594

---

資料來源

• AusCERT
• SUSE

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.2790
• https://www.auscert.org.au/bulletins/ESB-2022.2789
• https://www.auscert.org.au/bulletins/ESB-2022.2788
• https://www.auscert.org.au/bulletins/ESB-2022.2752
• https://www.auscert.org.au/bulletins/ESB-2022.2751
• https://www.auscert.org.au/bulletins/ESB-2022.2750
• https://www.auscert.org.au/bulletins/ESB-2022.2749
• https://www.suse.com/support/update/announcement/2022/suse-su-20222000-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221988-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221974-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221955-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221949-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221948-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221947-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

SUSE Linux Kernel Multiple Vulnerabilities

Last Update Date: 7 Jun 2022 Release Date: 6 Jun 2022

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in SUSE Products. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege and security restriction bypass on the targeted system.

 

[Updated on 2022-06-07]

Updated System / Technologies affected, Solutions and Related Links.

---

Impact

• Elevation of Privilege
• Security Restriction Bypass

---

System / Technologies affected

• SUSE Linux Enterprise High Performance Computing 15
• SUSE Linux Enterprise High Performance Computing 15-SP1
• SUSE Linux Enterprise High Performance Computing 15-SP2
• SUSE Linux Enterprise High Performance Computing 15-SP3
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Micro 5.1
• SUSE Linux Enterprise Module for Live Patching 15
• SUSE Linux Enterprise Module for Live Patching 15-SP1
• SUSE Linux Enterprise Module for Live Patching 15-SP2
• SUSE Linux Enterprise Module for Live Patching 15-SP3
• SUSE Linux Enterprise Server 15
• SUSE Linux Enterprise Server 15-SP1
• SUSE Linux Enterprise Server 15-SP2
• SUSE Linux Enterprise Server 15-SP3
• SUSE Linux Enterprise Server for SAP Applications 15
• SUSE Linux Enterprise Server for SAP Applications 15-SP1
• SUSE Linux Enterprise Server for SAP Applications 15-SP2
• SUSE Linux Enterprise Server for SAP Applications 15-SP3

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.suse.com/support/update/announcement/2022/suse-su-20222000-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221988-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221974-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221955-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221949-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221948-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221947-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

---

Vulnerability Identifier

• CVE-2022-1048
• CVE-2022-30594

---

Source

• AusCERT
• SUSE

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.2790
• https://www.auscert.org.au/bulletins/ESB-2022.2789
• https://www.auscert.org.au/bulletins/ESB-2022.2788
• https://www.auscert.org.au/bulletins/ESB-2022.2752
• https://www.auscert.org.au/bulletins/ESB-2022.2751
• https://www.auscert.org.au/bulletins/ESB-2022.2750
• https://www.auscert.org.au/bulletins/ESB-2022.2749
• https://www.suse.com/support/update/announcement/2022/suse-su-20222000-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221988-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221974-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221955-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20221949-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221948-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221947-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

NetApp 產品多個漏洞

發佈日期: 2022年06月06日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 NetApp 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料及資料篡改。

---

影響

• 阻斷服務
• 資料洩露
• 篡改

---

受影響之系統或技術

• AFF Baseboard Management Controller (BMC) - A700s
• Active IQ Unified Manager for VMware vSphere
• Clustered Data ONTAP
• Clustered Data ONTAP Antivirus Connector
• FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400
• FAS/AFF Baseboard Management Controller (BMC) - A250/500f
• NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H300E/H500E/H700E/H410S
• NetApp HCI Baseboard Management Controller (BMC) - H410C
• NetApp HCI Compute Node (Bootstrap OS)
• NetApp SANtricity SMI-S Provider
• NetApp SMI-S Provider
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)
• SnapManager for Hyper-V

---

解決方案

• 有關修補程式的更新，請瀏覽供應商之網站。
  • 軟件修補程式將通過 NetApp 網站的 “下載中心” 提供。
    https://mysupport.netapp.com/site/downloads/

---

漏洞識別碼

• CVE-2021-4157
• CVE-2021-4197
• CVE-2022-0435
• CVE-2022-1292
• CVE-2022-1343
• CVE-2022-1434
• CVE-2022-1473
• CVE-2022-29156

---

資料來源

• NetApp

---

相關連結

• https://security.netapp.com/advisory/ntap-20220602-0001/
• https://security.netapp.com/advisory/ntap-20220602-0002/
• https://security.netapp.com/advisory/ntap-20220602-0006/
• https://security.netapp.com/advisory/ntap-20220602-0007/
• https://security.netapp.com/advisory/ntap-20220602-0009/

NetApp Products Multiple Vulnerabilities

Release Date: 6 Jun 2022

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in NetApp Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and data manipulation on the targeted system.

---

Impact

• Denial of Service
• Information Disclosure
• Data Manipulation

---

System / Technologies affected

• AFF Baseboard Management Controller (BMC) - A700s
• Active IQ Unified Manager for VMware vSphere
• Clustered Data ONTAP
• Clustered Data ONTAP Antivirus Connector
• FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400
• FAS/AFF Baseboard Management Controller (BMC) - A250/500f
• NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H300E/H500E/H700E/H410S
• NetApp HCI Baseboard Management Controller (BMC) - H410C
• NetApp HCI Compute Node (Bootstrap OS)
• NetApp SANtricity SMI-S Provider
• NetApp SMI-S Provider
• NetApp SolidFire & HCI Management Node
• NetApp SolidFire, Enterprise SDS & HCI Storage Node (Element Software)
• SnapManager for Hyper-V

---

Solutions

• Please refer to the vendor web-site for update on patches release.
  • Software fixes will be made available through the NetApp Support website in the Software Download section.
    https://mysupport.netapp.com/site/downloads/

---

Vulnerability Identifier

• CVE-2021-4157
• CVE-2021-4197
• CVE-2022-0435
• CVE-2022-1292
• CVE-2022-1343
• CVE-2022-1434
• CVE-2022-1473
• CVE-2022-29156

---

Source

• NetApp

---

Related Link

• https://security.netapp.com/advisory/ntap-20220602-0001/
• https://security.netapp.com/advisory/ntap-20220602-0002/
• https://security.netapp.com/advisory/ntap-20220602-0006/
• https://security.netapp.com/advisory/ntap-20220602-0007/
• https://security.netapp.com/advisory/ntap-20220602-0009/

SUSE Linux 內核多個漏洞

發佈日期: 2022年06月06日

風險: 中度風險

類型: 操作系統 - LINUX

於 SUSE Products 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升及繞過保安限制。

---

影響

• 權限提升
• 繞過保安限制

---

受影響之系統或技術

• SUSE Linux Enterprise High Performance Computing 15-SP1
• SUSE Linux Enterprise Module for Live Patching 15-SP1
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Server 15-SP1
• SUSE Linux Enterprise Server for SAP Applications 15-SP1

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

---

漏洞識別碼

• CVE-2022-1048
• CVE-2022-30594

---

資料來源

• AusCERT
• SUSE

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.2752
• https://www.auscert.org.au/bulletins/ESB-2022.2751
• https://www.auscert.org.au/bulletins/ESB-2022.2750
• https://www.auscert.org.au/bulletins/ESB-2022.2749
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

SUSE Linux Kernel Multiple Vulnerabilities

Release Date: 6 Jun 2022

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in SUSE Products. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege and security restriction bypass on the targeted system.

---

Impact

• Elevation of Privilege
• Security Restriction Bypass

---

System / Technologies affected

• SUSE Linux Enterprise High Performance Computing 15-SP1
• SUSE Linux Enterprise Module for Live Patching 15-SP1
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Server 15-SP1
• SUSE Linux Enterprise Server for SAP Applications 15-SP1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

---

Vulnerability Identifier

• CVE-2022-1048
• CVE-2022-30594

---

Source

• AusCERT
• SUSE

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.2752
• https://www.auscert.org.au/bulletins/ESB-2022.2751
• https://www.auscert.org.au/bulletins/ESB-2022.2750
• https://www.auscert.org.au/bulletins/ESB-2022.2749
• https://www.suse.com/support/update/announcement/2022/suse-su-20221945-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221942-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221940-1
• https://www.suse.com/support/update/announcement/2022/suse-su-20221939-1

GitLab 多個漏洞

發佈日期: 2022年06月02日

風險: 中度風險

類型: 伺服器 - 其他伺服器

於 GitLab 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升、洩露敏感資料、繞過保安限制及跨網站指令碼。

---

影響

• 權限提升
• 資料洩露
• 繞過保安限制
• 跨網站指令碼

---

受影響之系統或技術

• GitLab Community Edition (CE) 5.0.1, 14.10.4, 及 14.9.5 以前的版本
• GitLab Enterprise Edition (CE) 5.0.1, 14.10.4, 及 14.9.5 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 供應商已提供更新
  https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/

---

漏洞識別碼

• CVE-2022-1680
• CVE-2022-1783
• CVE-2022-1821
• CVE-2022-1935
• CVE-2022-1936
• CVE-2022-1940
• CVE-2022-1944
• CVE-2022-1948

---

資料來源

• GitLab
• AusCERT

---

相關連結

• https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
• https://www.auscert.org.au/bulletins/ESB-2022.2712

GitLab Multiple Vulnerabilities

Release Date: 2 Jun 2022

RISK: Medium Risk

TYPE: Servers - Other Servers

Multiple vulnerabilities were identified in GitLab. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, sensitive information disclosure, security restriction bypass and cross-site scripting on the targeted system.

---

Impact

• Elevation of Privilege
• Information Disclosure
• Security Restriction Bypass
• Cross-Site Scripting

---

System / Technologies affected

• GitLab Community Edition (CE) versions prior to 15.0.1, 14.10.4, and 14.9.5
• GitLab Enterprise Edition (CE) versions prior to 15.0.1, 14.10.4, and 14.9.5

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

• The vendor has issued a fix
  https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/

---

Vulnerability Identifier

• CVE-2022-1680
• CVE-2022-1783
• CVE-2022-1821
• CVE-2022-1935
• CVE-2022-1936
• CVE-2022-1940
• CVE-2022-1944
• CVE-2022-1948

---

Source

• GitLab
• AusCERT

---

Related Link

• https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
• https://www.auscert.org.au/bulletins/ESB-2022.2712

Microsoft Edge 多個漏洞

發佈日期: 2022年06月02日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升、遠端執行任意程式碼、洩露敏感資料、繞過保安限制及仿冒。

---

影響

• 權限提升
• 遠端執行程式碼
• 資料洩露
• 繞過保安限制
• 仿冒

---

受影響之系統或技術

• Microsoft Edge 102.0.1245.30 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 102.0.1245.30 版本

---

漏洞識別碼

• CVE-2022-1853
• CVE-2022-1854
• CVE-2022-1855
• CVE-2022-1856
• CVE-2022-1857
• CVE-2022-1858
• CVE-2022-1859
• CVE-2022-1862
• CVE-2022-1863
• CVE-2022-1864
• CVE-2022-1865
• CVE-2022-1867
• CVE-2022-1868
• CVE-2022-1869
• CVE-2022-1870
• CVE-2022-1871
• CVE-2022-1872
• CVE-2022-1873
• CVE-2022-1874
• CVE-2022-1875
• CVE-2022-1876
• CVE-2022-26905
• CVE-2022-30127
• CVE-2022-30128

---

資料來源

• Microsoft Edge

---

相關連結

• https://msrc.microsoft.com/update-guide
• https://docs.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security

Microsoft Edge Multiple Vulnerabilities

Release Date: 2 Jun 2022

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution, sensitive information disclosure, security restriction bypass and spoofing on the targeted system.

---

Impact

• Elevation of Privilege
• Remote Code Execution
• Information Disclosure
• Security Restriction Bypass
• Spoofing

---

System / Technologies affected

• Microsoft Edge prior to 102.0.1245.30

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 102.0.1245.30

---

Vulnerability Identifier

• CVE-2022-1853
• CVE-2022-1854
• CVE-2022-1855
• CVE-2022-1856
• CVE-2022-1857
• CVE-2022-1858
• CVE-2022-1859
• CVE-2022-1862
• CVE-2022-1863
• CVE-2022-1864
• CVE-2022-1865
• CVE-2022-1867
• CVE-2022-1868
• CVE-2022-1869
• CVE-2022-1870
• CVE-2022-1871
• CVE-2022-1872
• CVE-2022-1873
• CVE-2022-1874
• CVE-2022-1875
• CVE-2022-1876
• CVE-2022-26905
• CVE-2022-30127
• CVE-2022-30128

---

Source

• Microsoft Edge

---

Related Link

• https://msrc.microsoft.com/update-guide
• https://docs.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security

Mozilla 產品多個漏洞

發佈日期: 2022年06月01日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、彷冒、遠端執行任意程式碼、洩露敏感資料、資料篡改及繞過保安限制。

---

影響

• 遠端執行程式碼
• 繞過保安限制
• 資料洩露
• 仿冒
• 阻斷服務
• 篡改

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Firefox 101
• Firefox ESR 91.10
• Thunderbird 91.10

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Firefox 101
• Firefox ESR 91.10
• Thunderbird 91.10

---

漏洞識別碼

• CVE-2022-1834
• CVE-2022-1919
• CVE-2022-31736
• CVE-2022-31737
• CVE-2022-31738
• CVE-2022-31739
• CVE-2022-31740
• CVE-2022-31741
• CVE-2022-31742
• CVE-2022-31743
• CVE-2022-31744
• CVE-2022-31745
• CVE-2022-31747
• CVE-2022-31748

---

資料來源

• AusCERT
• Mozilla

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.2686
• https://www.auscert.org.au/bulletins/ESB-2022.2685
• https://www.auscert.org.au/bulletins/ESB-2022.2684
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-20/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/

Mozilla Products Multiple Vulnerabilities

Release Date: 1 Jun 2022

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing, remote code execution, sensitive information disclosure, data manipulation and security restriction bypass on the targeted system.

---

Impact

• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure
• Spoofing
• Denial of Service
• Data Manipulation

---

System / Technologies affected

Versions prior to:

 

• Firefox 101
• Firefox ESR 91.10
• Thunderbird 91.10

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Firefox 101
• Firefox ESR 91.10
• Thunderbird 91.10

---

Vulnerability Identifier

• CVE-2022-1834
• CVE-2022-1919
• CVE-2022-31736
• CVE-2022-31737
• CVE-2022-31738
• CVE-2022-31739
• CVE-2022-31740
• CVE-2022-31741
• CVE-2022-31742
• CVE-2022-31743
• CVE-2022-31744
• CVE-2022-31745
• CVE-2022-31747
• CVE-2022-31748

---

Source

• AusCERT
• Mozilla

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.2686
• https://www.auscert.org.au/bulletins/ESB-2022.2685
• https://www.auscert.org.au/bulletins/ESB-2022.2684
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-20/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-21/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-22/