Apple Products Multiple Vulnerabilities

Release Date: 12 Dec 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing, remote code execution and information disclosure on the targeted system.

 

Note:

For CVE-2023-42916 and CVE-2023-42917, processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.1.

---

Impact

• Remote Code Execution
• Information Disclosure
• Spoofing
• Denial of Service

---

System / Technologies affected

• Versions prior to iOS 16.7.3 and iPadOS 16.7.3
• Versions prior to iOS 17.2 and iPadOS 17.2
• Versions prior to macOS Monterey 12.7.2
• Versions prior to macOS Ventura 13.6.3
• Versions prior to macOS Sonoma 14.2
• Versions prior to Safari 17.2
• Versions prior to tvOS 17.2
• Versions prior to watchOS 10.2

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• iOS 16.7.3 and iPadOS 16.7.3
• iOS 17.2 and iPadOS 17.2
• macOS Monterey 12.7.2
• macOS Ventura 13.6.3
• macOS Sonoma 14.2
• Safari 17.2
• tvOS 17.2
• watchOS 10.2

---

Vulnerability Identifier

• CVE-2020-19185
• CVE-2020-19186
• CVE-2020-19187
• CVE-2020-19188
• CVE-2020-19189
• CVE-2020-19190
• CVE-2023-5344
• CVE-2023-42842
• CVE-2023-42874
• CVE-2023-42882
• CVE-2023-42883
• CVE-2023-42884
• CVE-2023-42886
• CVE-2023-42890
• CVE-2023-42891
• CVE-2023-42894
• CVE-2023-42897
• CVE-2023-42898
• CVE-2023-42899
• CVE-2023-42900
• CVE-2023-42901
• CVE-2023-42902
• CVE-2023-42903
• CVE-2023-42904
• CVE-2023-42905
• CVE-2023-42906
• CVE-2023-42907
• CVE-2023-42908
• CVE-2023-42909
• CVE-2023-42910
• CVE-2023-42911
• CVE-2023-42912
• CVE-2023-42914
• CVE-2023-42916
• CVE-2023-42917
• CVE-2023-42919
• CVE-2023-42922
• CVE-2023-42923
• CVE-2023-42924
• CVE-2023-42926
• CVE-2023-42927
• CVE-2023-42932
• CVE-2023-45866

---

Source

• Apple

---

Related Link

• https://support.apple.com/en-us/HT214034
• https://support.apple.com/en-us/HT214035
• https://support.apple.com/en-us/HT214036
• https://support.apple.com/en-us/HT214037
• https://support.apple.com/en-us/HT214038
• https://support.apple.com/en-us/HT214039
• https://support.apple.com/en-us/HT214040
• https://support.apple.com/en-us/HT214041

Apache Struts 遠端執行程式碼漏洞

發佈日期: 2023年12月11日

風險: 中度風險

類型: 伺服器 - 網站伺服器

於 Apache Struts 發現一個漏洞。遠端使用者可利用此漏洞，於目標系統觸發遠端執行任意程式碼。

---

影響

• 遠端執行程式碼

---

受影響之系統或技術

• Struts 2.0.0 - Struts 2.3.37 (EOL)
• Struts 2.5.0 - Struts 2.5.32
• Struts 6.0.0 - Struts 6.3.0

---

解決方案

在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。

• 更新至 Struts 2.5.33, Struts 6.3.0.2 或更高版本

---

漏洞識別碼

• CVE-2023-50164

---

資料來源

• AusCERT
• Apache

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2023.7339.2
• https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
• https://cwiki.apache.org/confluence/display/WW/S2-066

Apache Struts Remote Code Execution Vulnerability

Release Date: 11 Dec 2023

RISK: Medium Risk

TYPE: Servers - Web Servers

A vulnerability has been identified in Apache Struts. A remote user can exploit this vulnerability to trigger remote code execution on the targeted system.

---

Impact

• Remote Code Execution

---

System / Technologies affected

• Struts 2.0.0 - Struts 2.3.37 (EOL)
• Struts 2.5.0 - Struts 2.5.32
• Struts 6.0.0 - Struts 6.3.0

---

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

• Upgrade to Struts 2.5.33, Struts 6.3.0.2 or greater

---

Vulnerability Identifier

• CVE-2023-50164

---

Source

• AusCERT
• Apache

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2023.7339.2
• https://lists.apache.org/thread/yh09b3fkf6vz5d6jdgrlvmg60lfwtqhj
• https://cwiki.apache.org/confluence/display/WW/S2-066

ChromeOS 多個漏洞

發佈日期: 2023年12月11日

風險: 中度風險

類型: 操作系統 - 其他操作系統

於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況及遠端執行任意程式碼。

---

影響

• 遠端執行程式碼
• 阻斷服務

---

受影響之系統或技術

• 114.0.5735.343 (平台版本: 15437.81.0) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式，詳情請參閱以下連結：

• https://chromereleases.googleblog.com/2023/12/long-term-support-channel-update-for.html

---

漏洞識別碼

• CVE-2023-5996
• CVE-2023-5997
• CVE-2023-6345
• CVE-2023-6347

---

資料來源

• Chrome

---

相關連結

• https://chromereleases.googleblog.com/2023/12/long-term-support-channel-update-for.html

ChromeOS Multiple Vulnerabilities

Release Date: 11 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Others OS

Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and remote code execution on the targeted system.

---

Impact

• Remote Code Execution
• Denial of Service

---

System / Technologies affected

• Version prior to 114.0.5735.343 (Platform Version: 15437.81.0)

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor. For detail, please refer to the link below:

• https://chromereleases.googleblog.com/2023/12/long-term-support-channel-update-for.html

---

Vulnerability Identifier

• CVE-2023-5996
• CVE-2023-5997
• CVE-2023-6345
• CVE-2023-6347

---

Source

• Chrome

---

Related Link

• https://chromereleases.googleblog.com/2023/12/long-term-support-channel-update-for.html

Microsoft Edge 多個漏洞

發佈日期: 2023年12月08日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端阻斷服務狀況、權限提升、執行任意程式碼及敏感資料洩露。

---

影響

• 阻斷服務
• 權限提升
• 遠端執行程式碼
• 資料洩露

---

受影響之系統或技術

• Microsoft Edge (Stable) 120.0.2210.61 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 Microsoft Edge (Stable) 120.0.2210.61 或之後版本

---

漏洞識別碼

• CVE-2023-6508
• CVE-2023-6509
• CVE-2023-6510
• CVE-2023-6511
• CVE-2023-6512
• CVE-2023-35618
• CVE-2023-36880
• CVE-2023-38174

---

資料來源

• Microsoft Edge

---

相關連結

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#december-7-2023
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6508
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6509
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6510
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6511
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6512
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35618
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36880
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38174

Microsoft Edge Multiple Vulnerabilities

Release Date: 8 Dec 2023

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge.  A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

---

Impact

• Denial of Service
• Elevation of Privilege
• Remote Code Execution
• Information Disclosure

---

System / Technologies affected

• Microsoft Edge (Stable) prior to 120.0.2210.61

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to Microsoft Edge (Stable) version 120.0.2210.61 or later

---

Vulnerability Identifier

• CVE-2023-6508
• CVE-2023-6509
• CVE-2023-6510
• CVE-2023-6511
• CVE-2023-6512
• CVE-2023-35618
• CVE-2023-36880
• CVE-2023-38174

---

Source

• Microsoft Edge

---

Related Link

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#december-7-2023
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6508
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6509
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6510
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6511
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6512
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35618
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36880
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38174

Google Chrome 多個漏洞

發佈日期: 2023年12月06日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼及阻斷服務狀況。

 

---

影響

• 遠端執行程式碼
• 阻斷服務

---

受影響之系統或技術

• Google Chrome 120.0.6099.62 (Linux) 之前的版本
• Google Chrome 120.0.6099.62 (Mac) 之前的版本
• Google Chrome 120.0.6099.62/.63 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 120.0.6099.62 (Linux) 或之後版本
• 更新至 120.0.6099.62 (Mac) 或之後版本
• 更新至 120.0.6099.62/.63 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2023-6508
• CVE-2023-6509
• CVE-2023-6510
• CVE-2023-6511
• CVE-2023-6512

---

資料來源

• Google Chrome

---

相關連結

• https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html

Google Chrome Multiple Vulnerabilities

Release Date: 6 Dec 2023

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome.  A remote attacker could exploit some of these vulnerabilities to trigger remote code execution and denial of service condition on the targeted system.

---

Impact

• Remote Code Execution
• Denial of Service

---

System / Technologies affected

• Google Chrome prior to 120.0.6099.62 (Linux)
• Google Chrome prior to 120.0.6099.62 (Mac)
• Google Chrome prior to 120.0.6099.62/.63 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 120.0.6099.62 (Linux) or later
• Update to version 120.0.6099.62 (Mac) or later
• Update to version 120.0.6099.62/.63 (Windows) or later

---

Vulnerability Identifier

• CVE-2023-6508
• CVE-2023-6509
• CVE-2023-6510
• CVE-2023-6511
• CVE-2023-6512

---

Source

• Google Chrome

---

Related Link

• https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-desktop.html

三星產品多個漏洞

發佈日期: 2023年12月06日

風險: 中度風險

類型: 操作系統 - 流動裝置及操作系統

於三星產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、權限提升、遠端執行程式碼、篡改及洩露敏感資料。

---

影響

• 繞過保安限制
• 篡改
• 遠端執行程式碼
• 權限提升
• 資料洩露

---

受影響之系統或技術

• Android 11, 12, 13, 14

有關受影響產品，請參閱以下連結:

https://security.samsungmobile.com/securityUpdate.smsb

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 安裝軟件供應商提供的修補程式：
  https://security.samsungmobile.com/securityUpdate.smsb

---

漏洞識別碼

• CVE-2023-20702
• CVE-2023-21267
• CVE-2023-21394
• CVE-2023-21671
• CVE-2023-22388
• CVE-2023-24852
• CVE-2023-28469
• CVE-2023-28545
• CVE-2023-28556
• CVE-2023-28574
• CVE-2023-32832
• CVE-2023-32834
• CVE-2023-32835
• CVE-2023-32836
• CVE-2023-32837
• CVE-2023-33031
• CVE-2023-33045
• CVE-2023-33047
• CVE-2023-33048
• CVE-2023-33055
• CVE-2023-33056
• CVE-2023-33059
• CVE-2023-33061
• CVE-2023-33074
• CVE-2023-35668
• CVE-2023-40073
• CVE-2023-40074
• CVE-2023-40075
• CVE-2023-40076
• CVE-2023-40077
• CVE-2023-40078
• CVE-2023-40079
• CVE-2023-40080
• CVE-2023-40081
• CVE-2023-40082
• CVE-2023-40083
• CVE-2023-40084
• CVE-2023-40087
• CVE-2023-40088
• CVE-2023-40089
• CVE-2023-40090
• CVE-2023-40091
• CVE-2023-40092
• CVE-2023-40094
• CVE-2023-40095
• CVE-2023-40096
• CVE-2023-40097
• CVE-2023-40098
• CVE-2023-40103
• CVE-2023-42483
• CVE-2023-42556
• CVE-2023-42557
• CVE-2023-42558
• CVE-2023-42559
• CVE-2023-42560
• CVE-2023-42561
• CVE-2023-42562
• CVE-2023-42563
• CVE-2023-42564
• CVE-2023-42565
• CVE-2023-42566
• CVE-2023-42567
• CVE-2023-42568
• CVE-2023-42569
• CVE-2023-42570
• CVE-2023-45773
• CVE-2023-45774
• CVE-2023-45775
• CVE-2023-45776
• CVE-2023-45777
• CVE-2023-45781
• CVE-2023-45864

---

資料來源

• https://security.samsungmobile.com/securityUpdate.smsb

---

相關連結

• https://security.samsungmobile.com/securityUpdate.smsb

Samsung Products Multiple Vulnerabilities

Release Date: 6 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Samsung Products. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, elevation of privilege, remote code execution, data manipulation and sensitive information disclosure on the targeted system.

---

Impact

• Security Restriction Bypass
• Data Manipulation
• Remote Code Execution
• Elevation of Privilege
• Information Disclosure

---

System / Technologies affected

• Android 11, 12, 13, 14

For affected products, please refer to the link below:

https://security.samsungmobile.com/securityUpdate.smsb

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor:
  https://security.samsungmobile.com/securityUpdate.smsb

---

Vulnerability Identifier

• CVE-2023-20702
• CVE-2023-21267
• CVE-2023-21394
• CVE-2023-21671
• CVE-2023-22388
• CVE-2023-24852
• CVE-2023-28469
• CVE-2023-28545
• CVE-2023-28556
• CVE-2023-28574
• CVE-2023-32832
• CVE-2023-32834
• CVE-2023-32835
• CVE-2023-32836
• CVE-2023-32837
• CVE-2023-33031
• CVE-2023-33045
• CVE-2023-33047
• CVE-2023-33048
• CVE-2023-33055
• CVE-2023-33056
• CVE-2023-33059
• CVE-2023-33061
• CVE-2023-33074
• CVE-2023-35668
• CVE-2023-40073
• CVE-2023-40074
• CVE-2023-40075
• CVE-2023-40076
• CVE-2023-40077
• CVE-2023-40078
• CVE-2023-40079
• CVE-2023-40080
• CVE-2023-40081
• CVE-2023-40082
• CVE-2023-40083
• CVE-2023-40084
• CVE-2023-40087
• CVE-2023-40088
• CVE-2023-40089
• CVE-2023-40090
• CVE-2023-40091
• CVE-2023-40092
• CVE-2023-40094
• CVE-2023-40095
• CVE-2023-40096
• CVE-2023-40097
• CVE-2023-40098
• CVE-2023-40103
• CVE-2023-42483
• CVE-2023-42556
• CVE-2023-42557
• CVE-2023-42558
• CVE-2023-42559
• CVE-2023-42560
• CVE-2023-42561
• CVE-2023-42562
• CVE-2023-42563
• CVE-2023-42564
• CVE-2023-42565
• CVE-2023-42566
• CVE-2023-42567
• CVE-2023-42568
• CVE-2023-42569
• CVE-2023-42570
• CVE-2023-45773
• CVE-2023-45774
• CVE-2023-45775
• CVE-2023-45776
• CVE-2023-45777
• CVE-2023-45781
• CVE-2023-45864

---

Source

• https://security.samsungmobile.com/securityUpdate.smsb

---

Related Link

• https://security.samsungmobile.com/securityUpdate.smsb

Android多個漏洞

發佈日期: 2023年12月05日

風險: 中度風險

類型: 操作系統 - 流動裝置及操作系統

於 Android 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、遠端執行程式碼及洩露敏感資料。

---

影響

• 阻斷服務
• 權限提升
• 資料洩露
• 遠端執行程式碼

---

受影響之系統或技術

• 2023-12-04 前的 Android 保安更新級別

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 安裝軟件供應商提供的修補程式：
  https://source.android.com/docs/security/bulletin/2023-12-01

---

漏洞識別碼

• CVE-2023-21267
• CVE-2023-21394
• CVE-2023-35668
• CVE-2023-40073
• CVE-2023-40074
• CVE-2023-40075
• CVE-2023-40076
• CVE-2023-40077
• CVE-2023-40078
• CVE-2023-40079
• CVE-2023-40080
• CVE-2023-40081
• CVE-2023-40082
• CVE-2023-40083
• CVE-2023-40084
• CVE-2023-40087
• CVE-2023-40088
• CVE-2023-40089
• CVE-2023-40090
• CVE-2023-40091
• CVE-2023-40092
• CVE-2023-40094
• CVE-2023-40095
• CVE-2023-40096
• CVE-2023-40097
• CVE-2023-40098
• CVE-2023-40103
• CVE-2023-45773
• CVE-2023-45774
• CVE-2023-45775
• CVE-2023-45776
• CVE-2023-45777
• CVE-2023-45781
• CVE-2023-45866

---

資料來源

• Android

---

相關連結

• https://source.android.com/docs/security/bulletin/2023-12-01

Android Multiple Vulnerabilities

Release Date: 5 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

---

Impact

• Denial of Service
• Elevation of Privilege
• Information Disclosure
• Remote Code Execution

---

System / Technologies affected

• Android security patch level prior to 2023-12-04

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor:
  https://source.android.com/docs/security/bulletin/2023-12-01

---

Vulnerability Identifier

• CVE-2023-21267
• CVE-2023-21394
• CVE-2023-35668
• CVE-2023-40073
• CVE-2023-40074
• CVE-2023-40075
• CVE-2023-40076
• CVE-2023-40077
• CVE-2023-40078
• CVE-2023-40079
• CVE-2023-40080
• CVE-2023-40081
• CVE-2023-40082
• CVE-2023-40083
• CVE-2023-40084
• CVE-2023-40087
• CVE-2023-40088
• CVE-2023-40089
• CVE-2023-40090
• CVE-2023-40091
• CVE-2023-40092
• CVE-2023-40094
• CVE-2023-40095
• CVE-2023-40096
• CVE-2023-40097
• CVE-2023-40098
• CVE-2023-40103
• CVE-2023-45773
• CVE-2023-45774
• CVE-2023-45775
• CVE-2023-45776
• CVE-2023-45777
• CVE-2023-45781
• CVE-2023-45866

---

Source

• Android

---

Related Link

• https://source.android.com/docs/security/bulletin/2023-12-01

蘋果產品多個漏洞

發佈日期: 2023年12月01日

風險: 極高度風險

類型: 操作系統 - 流動裝置及操作系統

於蘋果產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼及資料洩露。

 

注意:

對於 CVE-2023-42916及CVE-2023-42917，處理網頁內容時可能導致任意代碼執行。蘋果知悉有報告指出，這個問題可能已在 iOS 16.7.1 之前的 iOS 版本中被廣泛利用。

 

---

影響

• 遠端執行程式碼
• 資料洩露

---

受影響之系統或技術

• Safari 17.1.2 以前的版本
• iOS 17.1.2 以前的版本
• iPadOS 17.1.2 以前的版本
• macOS Sonoma 14.1.2 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝供應商提供的修補程式：

 

• Safari 17.1.2
• iOS 17.1.2
• iPadOS 17.1.2
• macOS Sonoma 14.1.2

 

---

漏洞識別碼

• CVE-2023-42916
• CVE-2023-42917

---

資料來源

• Apple

---

相關連結

• https://support.apple.com/en-us/HT214031
• https://support.apple.com/en-us/HT214032
• https://support.apple.com/en-us/HT214033

Apple Products Multiple Vulnerabilities

Release Date: 1 Dec 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger  remote code execution and information disclosure on the targeted system.

 

Note:

For CVE-2023-42916 and CVE-2023-42917, processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.1.

---

Impact

• Remote Code Execution
• Information Disclosure

---

System / Technologies affected

• Versions prior to Safari Safari 17.1.2
• Versions prior to iOS 17.1.2
• Versions prior to iPadOS 17.1.2
• Versions prior to macOS Sonoma 14.1.2

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Safari 17.1.2
• iOS 17.1.2
• iPadOS 17.1.2
• macOS Sonoma 14.1.2

---

Vulnerability Identifier

• CVE-2023-42916
• CVE-2023-42917

---

Source

• Apple

---

Related Link

• https://support.apple.com/en-us/HT214031
• https://support.apple.com/en-us/HT214032
• https://support.apple.com/en-us/HT214033

Ubuntu Linux 核心多個漏洞

發佈日期: 2023年12月01日

風險: 中度風險

類型: 操作系統 - LINUX

於 Ubuntu 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、權限提升及敏感資料洩露。

 

---

影響

• 阻斷服務
• 遠端執行程式碼
• 資料洩露
• 權限提升

---

受影響之系統或技術

• Ubuntu 14.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 18.04 ESM
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 23.04

 

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://ubuntu.com/security/notices/USN-6496-2
• https://ubuntu.com/security/notices/USN-6495-2
• https://ubuntu.com/security/notices/USN-6502-4
• https://ubuntu.com/security/notices/USN-6494-2

---

漏洞識別碼

• CVE-2023-5090
• CVE-2023-5345
• CVE-2023-5717
• CVE-2023-25775
• CVE-2023-31085
• CVE-2023-39189
• CVE-2023-39192
• CVE-2023-39193
• CVE-2023-39194
• CVE-2023-42754
• CVE-2023-45862
• CVE-2023-45871

---

資料來源

• Ubuntu

---

相關連結

• https://ubuntu.com/security/notices/USN-6496-2
• https://ubuntu.com/security/notices/USN-6495-2
• https://ubuntu.com/security/notices/USN-6502-4
• https://ubuntu.com/security/notices/USN-6494-2

Ubuntu Linux Kernel Multiple Vulnerabilities

Release Date: 1 Dec 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in Ubuntu Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, elevation of privilege and sensitive information disclosure on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Information Disclosure
• Elevation of Privilege

---

System / Technologies affected

• Ubuntu 14.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 18.04 ESM
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 23.04

 

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://ubuntu.com/security/notices/USN-6496-2
• https://ubuntu.com/security/notices/USN-6495-2
• https://ubuntu.com/security/notices/USN-6502-4
• https://ubuntu.com/security/notices/USN-6494-2

---

Vulnerability Identifier

• CVE-2023-5090
• CVE-2023-5345
• CVE-2023-5717
• CVE-2023-25775
• CVE-2023-31085
• CVE-2023-39189
• CVE-2023-39192
• CVE-2023-39193
• CVE-2023-39194
• CVE-2023-42754
• CVE-2023-45862
• CVE-2023-45871

---

Source

• Ubuntu

---

Related Link

• https://ubuntu.com/security/notices/USN-6496-2
• https://ubuntu.com/security/notices/USN-6495-2
• https://ubuntu.com/security/notices/USN-6502-4
• https://ubuntu.com/security/notices/USN-6494-2

Microsoft Edge 多個漏洞

發佈日期: 2023年11月30日

風險: 極高度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、篡改、遠端執行任意程式碼及阻斷服務狀況。

 

注意:

對於CVE-2023-6345，Skia（開源 2D 圖像函式庫）整數溢出，可以導致遠端執行任意程式碼。Google 獲悉有報告指出此問題可能已被廣泛利用。

---

影響

• 遠端執行程式碼
• 阻斷服務
• 篡改
• 繞過保安限制

---

受影響之系統或技術

• Microsoft Edge (Stable) 119.0.2151.97 之前的版本
• Microsoft Edge (Extended Stable) 118.0.2088.122 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 Microsoft Edge (Stable) 119.0.2151.97 或之後版本
• 更新至 Microsoft Edge (Extended Stable) 118.0.2088.122 或之後版本

---

漏洞識別碼

• CVE-2023-6345
• CVE-2023-6346
• CVE-2023-6347
• CVE-2023-6348
• CVE-2023-6350
• CVE-2023-6351

---

資料來源

• Microsoft Edge

---

相關連結

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#november-29-2023
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6345
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6346
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6347
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6348
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6350
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6351

Microsoft Edge Multiple Vulnerabilities

Release Date: 30 Nov 2023

RISK: Extremely High Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, data manipulation, remote code execution and denial of service condition on the targeted system.

 

Note:

For CVE-2023-6345, Integer overflow in Skia (open-source 2D graphics library), the vulnerability could result in remote code execution. Google is aware of a report that this issue may have been exploited in the wild.

---

Impact

• Remote Code Execution
• Denial of Service
• Data Manipulation
• Security Restriction Bypass

---

System / Technologies affected

• Microsoft Edge (Stable) prior to 119.0.2151.97
• Microsoft Edge (Extended Stable) prior to 118.0.2088.122

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to Microsoft Edge (Stable) version 119.0.2151.97 or later
• Update to Microsoft Edge (Extended Stable) version 118.0.2088.122 or later

---

Vulnerability Identifier

• CVE-2023-6345
• CVE-2023-6346
• CVE-2023-6347
• CVE-2023-6348
• CVE-2023-6350
• CVE-2023-6351

---

Source

• Microsoft Edge

---

Related Link

• https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security#november-29-2023
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6345
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6346
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6347
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6348
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6350
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-6351

Google Chrome 多個漏洞

發佈日期: 2023年11月29日

風險: 極高度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、篡改、遠端執行任意程式碼及阻斷服務狀況。

 

注意:

對於CVE-2023-6345，Skia（開源 2D 圖像函式庫）整數溢出，可以導致遠端執行任意程式碼。Google在報告指出，這個問題可能已在 119.0.6045.199 之前的 Chrome 版本中被廣泛利用。

 

---

影響

• 遠端執行程式碼
• 阻斷服務
• 繞過保安限制
• 篡改

---

受影響之系統或技術

• Google Chrome 119.0.6045.199 (Linux) 之前的版本
• Google Chrome 119.0.6045.199 (Mac) 之前的版本
• Google Chrome 119.0.6045.199/.200 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 119.0.6045.199 (Linux) 或之後版本
• 更新至 119.0.6045.199 (Mac) 或之後版本
• 更新至 119.0.6045.199/.200 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2023-6345
• CVE-2023-6346
• CVE-2023-6347
• CVE-2023-6348
• CVE-2023-6350
• CVE-2023-6351

---

資料來源

• Google Chrome

---

相關連結

• https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html

Google Chrome Multiple Vulnerabilities

Release Date: 29 Nov 2023

RISK: Extremely High Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome.  A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass, data manipulation, remote code execution and denial of service condition on the targeted system.

 

Note:

For CVE-2023-6345, Integer overflow in Skia (open-source 2D graphics library), the vulnerability could result in remote code execution. Google is aware of a report that this issue may have been exploited in the wild against versions of Chrome before 119.0.6045.199.

---

Impact

• Remote Code Execution
• Denial of Service
• Security Restriction Bypass
• Data Manipulation

---

System / Technologies affected

• Google Chrome prior to 119.0.6045.199 (Linux)
• Google Chrome prior to 119.0.6045.199 (Mac)
• Google Chrome prior to 119.0.6045.199/.200 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 119.0.6045.199 (Linux) or later
• Update to version 119.0.6045.199 (Mac) or later
• Update to version 119.0.6045.199/.200 (Windows) or later

---

Vulnerability Identifier

• CVE-2023-6345
• CVE-2023-6346
• CVE-2023-6347
• CVE-2023-6348
• CVE-2023-6350
• CVE-2023-6351

---

Source

• Google Chrome

---

Related Link

• https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html