LibreOffice Remote Code Execution Vulnerability

Release Date: 24 Oct 2022

RISK: Medium Risk

TYPE: Clients - Productivity Products

A vulnerability was identified in LibreOffice. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

---

Impact

• Remote Code Execution

---

System / Technologies affected

• LibreOffice Version prior to 7.3.6
• LibreOffice Version prior to 7.4.1

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update LibreOffice to version 7.3.6
• Update LibreOffice to version 7.4.1

---

Vulnerability Identifier

• CVE-2022-3140

---

Source

• LibreOffice

---

Related Link

• https://www.libreoffice.org/about-us/security/advisories/cve-2022-3140/

思科產品多個漏洞

發佈日期: 2022年10月21日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於思科產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、洩露敏感資料及繞過保安限制。

---

影響

• 阻斷服務
• 資料洩露
• 繞過保安限制

---

受影響之系統或技術

• Cisco Meraki MX and have Cisco AnyConnect VPN enabled
• Z3 Teleworker Gateway VPN
• Cisco Identity Services Engine

 

詳情請參閱以下連結﹕

 

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

---

漏洞識別碼

• CVE-2022-20822
• CVE-2022-20933

---

資料來源

• Cisco
• AusCERT

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.5210
• https://www.auscert.org.au/bulletins/ESB-2022.5209
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

Cisco Products Multiple Vulnerabilities

Release Date: 21 Oct 2022

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Cisco Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Information Disclosure
• Security Restriction Bypass

---

System / Technologies affected

• Cisco Meraki MX and have Cisco AnyConnect VPN enabled
• Z3 Teleworker Gateway VPN
• Cisco Identity Services Engine

 

Please refer to the link below for detail:

 

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

---

Vulnerability Identifier

• CVE-2022-20822
• CVE-2022-20933

---

Source

• Cisco
• AusCERT

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.5210
• https://www.auscert.org.au/bulletins/ESB-2022.5209
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-meraki-mx-vpn-dos-vnESbgBf
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM

F5 產品多個漏洞

發佈日期: 2022年10月21日

風險: 中度風險

類型: 操作系統 - Network

於 F5 產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料及繞過保安限制。

---

影響

• 阻斷服務
• 權限提升
• 遠端執行程式碼
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

• BIG-IP (Advanced WAF, ASM)
• BIG-IP (AFM)
• BIG-IP (AFM, PEM)
• BIG-IP (all modules)
• BIG-IP (DNS, LTM enabled with DNS Services license)
• BIG-IQ Centralized Management
• F5OS-A
• F5OS-C

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://support.f5.com/csp/article/K30425568

---

漏洞識別碼

• CVE-2021-40490
• CVE-2022-36795
• CVE-2022-38177
• CVE-2022-41617
• CVE-2022-41624
• CVE-2022-41691
• CVE-2022-41694
• CVE-2022-41741
• CVE-2022-41742
• CVE-2022-41743
• CVE-2022-41770
• CVE-2022-41780
• CVE-2022-41787
• CVE-2022-41806
• CVE-2022-41813
• CVE-2022-41832
• CVE-2022-41833
• CVE-2022-41835
• CVE-2022-41836
• CVE-2022-41983

---

資料來源

• F5

---

相關連結

• https://support.f5.com/csp/article/K30425568

F5 Products Multiple Vulnerabilities

Release Date: 21 Oct 2022

RISK: Medium Risk

TYPE: Operating Systems - Networks OS

Multiple vulnerabilities were identified in F5 Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Elevation of Privilege
• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• BIG-IP (Advanced WAF, ASM)
• BIG-IP (AFM)
• BIG-IP (AFM, PEM)
• BIG-IP (all modules)
• BIG-IP (DNS, LTM enabled with DNS Services license)
• BIG-IQ Centralized Management
• F5OS-A
• F5OS-C

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://support.f5.com/csp/article/K30425568

---

Vulnerability Identifier

• CVE-2021-40490
• CVE-2022-36795
• CVE-2022-38177
• CVE-2022-41617
• CVE-2022-41624
• CVE-2022-41691
• CVE-2022-41694
• CVE-2022-41741
• CVE-2022-41742
• CVE-2022-41743
• CVE-2022-41770
• CVE-2022-41780
• CVE-2022-41787
• CVE-2022-41806
• CVE-2022-41813
• CVE-2022-41832
• CVE-2022-41833
• CVE-2022-41835
• CVE-2022-41836
• CVE-2022-41983

---

Source

• F5

---

Related Link

• https://support.f5.com/csp/article/K30425568

思科產品多個漏洞

最後更新 2022年10月21日 發佈日期: 2022年10月06日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

在思科產品發現多個漏洞，遠端攻擊者可利用這些漏洞在目標系統觸發繞過保安限制、遠端執行程式碼、篡改、權限提升及跨網站指令碼。

 

[Updated on 2022-10-21]

注意：CVE-2022-20917 的概念驗證碼已被公開

---

影響

• 繞過保安限制
• 權限提升
• 遠端執行程式碼
• 篡改
• 跨網站指令碼

---

受影響之系統或技術

• Cisco Enterprise NFV Infrastructure Software
• Cisco Expressway Series and Cisco TelePresence Video Communication Server
• Cisco Touch 10 Devices
• Cisco Secure Web Appliance Content Encoding Filter
• Cisco BroadWorks Hosted Thin Receptionist
• Cisco ATA 190 Series Analog Telephone Adapter Software
• Cisco Smart Software Manager On-Prem

概念驗證碼已被公開:

• Cisco Jabber Client Software Extensible Messaging and Presence Protocol

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-ISV-BQrvEv2h
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv

概念驗證碼已被公開:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

---

漏洞識別碼

• CVE-2022-20686
• CVE-2022-20687
• CVE-2022-20688
• CVE-2022-20689
• CVE-2022-20690
• CVE-2022-20691
• CVE-2022-20766
• CVE-2022-20793
• CVE-2022-20814
• CVE-2022-20853
• CVE-2022-20917
• CVE-2022-20929
• CVE-2022-20931
• CVE-2022-20939
• CVE-2022-20948
• CVE-2022-20952

---

資料來源

• Cisco

---

相關連結

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-ISV-BQrvEv2h
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

Cisco Products Multiple Vulnerabilities

Last Update Date: 21 Oct 2022 Release Date: 6 Oct 2022

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Cisco Products. A remote attacker could exploit some of these vulnerabilities to security restriction bypass, remote code execution, data manipulation, elevation of privilege and cross-site scripting the targeted system.

 

[Updated on 2022-10-21]

Notes: Proof Of Concept Exploit Code Is Publicly Available for CVE-2022-20917

---

Impact

• Security Restriction Bypass
• Elevation of Privilege
• Remote Code Execution
• Data Manipulation
• Cross-Site Scripting

---

System / Technologies affected

• Cisco Enterprise NFV Infrastructure Software
• Cisco Expressway Series and Cisco TelePresence Video Communication Server
• Cisco Touch 10 Devices
• Cisco Secure Web Appliance Content Encoding Filter
• Cisco BroadWorks Hosted Thin Receptionist
• Cisco ATA 190 Series Analog Telephone Adapter Software
• Cisco Smart Software Manager On-Prem

Proof Of Concept Exploit Code Is Publicly Available:

• Cisco Jabber Client Software Extensible Messaging and Presence Protocol

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-ISV-BQrvEv2h
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv

Proof Of Concept Exploit Code Is Publicly Available:

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

---

Vulnerability Identifier

• CVE-2022-20686
• CVE-2022-20687
• CVE-2022-20688
• CVE-2022-20689
• CVE-2022-20690
• CVE-2022-20691
• CVE-2022-20766
• CVE-2022-20793
• CVE-2022-20814
• CVE-2022-20853
• CVE-2022-20917
• CVE-2022-20929
• CVE-2022-20931
• CVE-2022-20939
• CVE-2022-20948
• CVE-2022-20952

---

Source

• Cisco

---

Related Link

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-ISV-BQrvEv2h
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-DAV-HSvEHHEt
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-CTT-IVV-4A66Dsfj
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-bypass-bwBfugek
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-GEZYVvs
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

Mozilla Firefox 多個漏洞

發佈日期: 2022年10月20日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Mozilla Firefox 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、洩露敏感資料。

---

影響

• 遠端執行程式碼
• 資料洩露
• 阻斷服務

---

受影響之系統或技術

以下版本之前的版本﹕

 

• Firefox 106
• Firefox ESR 102.4

---

解決方案

在安裝軟體之前，請先瀏覽供應商之官方網站，以獲得更多詳細資料。

更新至版本:

 

• Firefox 106
• Firefox ESR 102.4

---

漏洞識別碼

• CVE-2022-42927
• CVE-2022-42928
• CVE-2022-42929
• CVE-2022-42930
• CVE-2022-42931
• CVE-2022-42932

---

資料來源

• Mozilla

---

相關連結

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-44/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/

Mozilla Firefox Multiple Vulnerabilities

Release Date: 20 Oct 2022

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Firefox. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and sensitive information disclosure on the targeted system.

---

Impact

• Remote Code Execution
• Information Disclosure
• Denial of Service

---

System / Technologies affected

Versions prior to:

 

• Firefox 106
• Firefox ESR 102.4

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Firefox 106
• Firefox ESR 102.4

---

Vulnerability Identifier

• CVE-2022-42927
• CVE-2022-42928
• CVE-2022-42929
• CVE-2022-42930
• CVE-2022-42931
• CVE-2022-42932

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2022-44/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/

Linux 內核多個漏洞

最後更新 2022年10月20日 發佈日期: 2022年10月18日

風險: 中度風險

類型: 操作系統 - LINUX

於Linux 內核發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、遠端執行任意程式碼、洩露敏感資料及繞過保安限制。

 

[更新於 2022-10-20] 

新增 Redhat 漏洞到以下部份。

---

影響

• 阻斷服務
• 權限提升
• 資料洩露
• 繞過保安限制
• 遠端執行程式碼

---

受影響之系統或技術

• openSUSE Leap 15.3
• openSUSE Leap 15.4
• SUSE Linux Enterprise Desktop 12-SP5
• SUSE Linux Enterprise High Availability 12-SP4
• SUSE Linux Enterprise High Availability 12-SP5
• SUSE Linux Enterprise High Performance Computing 12-SP4
• SUSE Linux Enterprise High Performance Computing 12-SP5
• SUSE Linux Enterprise High Performance Computing 15-SP2
• SUSE Linux Enterprise High Performance Computing 15-SP3
• SUSE Linux Enterprise High Performance Computing 15-SP4
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Micro 5.1
• SUSE Linux Enterprise Module for Live Patching 15-SP2
• SUSE Linux Enterprise Module for Live Patching 15-SP3
• SUSE Linux Enterprise Module for Live Patching 15-SP4
• SUSE Linux Enterprise Module for Public Cloud 15-SP3
• SUSE Linux Enterprise Module for Public Cloud 15-SP4
• SUSE Linux Enterprise Server 12-SP3-BCL
• SUSE Linux Enterprise Server 12-SP4
• SUSE Linux Enterprise Server 12-SP4-LTSS
• SUSE Linux Enterprise Server 12-SP5
• SUSE Linux Enterprise Server 15-SP2
• SUSE Linux Enterprise Server 15-SP3
• SUSE Linux Enterprise Server 15-SP4
• SUSE Linux Enterprise Server for SAP 12-SP4
• SUSE Linux Enterprise Server for SAP Applications 12-SP5
• SUSE Linux Enterprise Server for SAP Applications 15-SP2
• SUSE Linux Enterprise Server for SAP Applications 15-SP3
• SUSE Linux Enterprise Server for SAP Applications 15-SP4
• SUSE Linux Enterprise Software Development Kit 12-SP5
• SUSE Linux Enterprise Storage 7.1
• SUSE Linux Enterprise Workstation Extension 12-SP5
• SUSE Manager Proxy 4.2
• SUSE Manager Proxy 4.3
• SUSE Manager Retail Branch Server 4.2
• SUSE Manager Retail Branch Server 4.3
• SUSE Manager Server 4.2
• SUSE Manager Server 4.3
• SUSE OpenStack Cloud 9
• SUSE OpenStack Cloud Crowbar 9
• Ubuntu 14.04 ESM
• Ubuntu 16.04 ESM 
• Ubuntu 18.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

For SUSE

安裝供應商提供的修補程式：

• https://www.suse.com/support/update/announcement/2022/suse-su-20223584-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223585-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223586-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223587-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223599-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223601-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223605-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223606-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223607-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223609-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223628-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223648-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223657-1/

 

For Ubuntu

安裝供應商提供的修補程式：

• https://ubuntu.com/security/notices/USN-5682-1
• https://ubuntu.com/security/notices/USN-5683-1
• https://ubuntu.com/security/notices/USN-5684-1
• https://ubuntu.com/security/notices/USN-5687-1
• https://ubuntu.com/security/notices/USN-5691-1
• https://ubuntu.com/security/notices/USN-5692-1
• https://ubuntu.com/security/notices/USN-5693-1

 

For Redhat

安裝供應商提供的修補程式：

• https://access.redhat.com/errata/RHSA-2022:6978
• https://access.redhat.com/errata/RHSA-2022:6983
• https://access.redhat.com/errata/RHSA-2022:6991

---

漏洞識別碼

• CVE-2016-3695
• CVE-2020-16119
• CVE-2020-27784
• CVE-2020-36516
• CVE-2021-4155
• CVE-2021-4159
• CVE-2021-4203
• CVE-2021-33655
• CVE-2021-39698
• CVE-2021-45485
• CVE-2021-45486
• CVE-2022-0812
• CVE-2022-1012
• CVE-2022-1263
• CVE-2022-1882
• CVE-2022-2318
• CVE-2022-2503
• CVE-2022-2586
• CVE-2022-2588
• CVE-2022-2602
• CVE-2022-2639
• CVE-2022-2663
• CVE-2022-2905
• CVE-2022-2977
• CVE-2022-2978
• CVE-2022-3028
• CVE-2022-3176
• CVE-2022-3202
• CVE-2022-3239
• CVE-2022-3303
• CVE-2022-20008
• CVE-2022-20368
• CVE-2022-20369
• CVE-2022-21123
• CVE-2022-21125
• CVE-2022-21166
• CVE-2022-26365
• CVE-2022-26373
• CVE-2022-32296
• CVE-2022-33740
• CVE-2022-33741
• CVE-2022-33742
• CVE-2022-33743
• CVE-2022-33744
• CVE-2022-34494
• CVE-2022-34495
• CVE-2022-36879
• CVE-2022-36946
• CVE-2022-39188
• CVE-2022-39189
• CVE-2022-39190
• CVE-2022-40768
• CVE-2022-41218
• CVE-2022-41222
• CVE-2022-41674
• CVE-2022-41848
• CVE-2022-41849
• CVE-2022-42719
• CVE-2022-42720
• CVE-2022-42721
• CVE-2022-42722

---

資料來源

• AusCERT
• Ubuntu
• SUSE
• Redhat

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2022.5120
• https://www.auscert.org.au/bulletins/ESB-2022.5122
• https://www.auscert.org.au/bulletins/ESB-2022.5123
• https://www.auscert.org.au/bulletins/ESB-2022.5124
• https://www.auscert.org.au/bulletins/ESB-2022.5125
• https://www.auscert.org.au/bulletins/ESB-2022.5127
• https://www.auscert.org.au/bulletins/ESB-2022.5130
• https://www.auscert.org.au/bulletins/ESB-2022.5136
• https://www.auscert.org.au/bulletins/ESB-2022.5158
• https://www.auscert.org.au/bulletins/ESB-2022.5160
• https://www.auscert.org.au/bulletins/ESB-2022.5161
• https://www.auscert.org.au/bulletins/ESB-2022.5164
• https://www.auscert.org.au/bulletins/ESB-2022.5166
• https://www.suse.com/support/update/announcement/2022/suse-su-20223584-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223585-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223586-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223587-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223599-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223601-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223605-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223606-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223607-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223609-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223628-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223648-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223657-1/
• https://ubuntu.com/security/notices/USN-5682-1
• https://ubuntu.com/security/notices/USN-5683-1
• https://ubuntu.com/security/notices/USN-5684-1
• https://ubuntu.com/security/notices/USN-5687-1
• https://ubuntu.com/security/notices/USN-5691-1
• https://ubuntu.com/security/notices/USN-5692-1
• https://ubuntu.com/security/notices/USN-5693-1
• https://access.redhat.com/errata/RHSA-2022:6978
• https://access.redhat.com/errata/RHSA-2022:6983
• https://access.redhat.com/errata/RHSA-2022:6991

Linux Kernel Multiple Vulnerabilities

Last Update Date: 20 Oct 2022 Release Date: 18 Oct 2022

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

 

[Updated on 2022-10-20]

Added Redhat vulnerabilities to the below sections.

---

Impact

• Denial of Service
• Elevation of Privilege
• Information Disclosure
• Security Restriction Bypass
• Remote Code Execution

---

System / Technologies affected

• openSUSE Leap 15.3
• openSUSE Leap 15.4
• SUSE Linux Enterprise Desktop 12-SP5
• SUSE Linux Enterprise High Availability 12-SP4
• SUSE Linux Enterprise High Availability 12-SP5
• SUSE Linux Enterprise High Performance Computing 12-SP4
• SUSE Linux Enterprise High Performance Computing 12-SP5
• SUSE Linux Enterprise High Performance Computing 15-SP2
• SUSE Linux Enterprise High Performance Computing 15-SP3
• SUSE Linux Enterprise High Performance Computing 15-SP4
• SUSE Linux Enterprise Live Patching 12-SP4
• SUSE Linux Enterprise Live Patching 12-SP5
• SUSE Linux Enterprise Micro 5.1
• SUSE Linux Enterprise Module for Live Patching 15-SP2
• SUSE Linux Enterprise Module for Live Patching 15-SP3
• SUSE Linux Enterprise Module for Live Patching 15-SP4
• SUSE Linux Enterprise Module for Public Cloud 15-SP3
• SUSE Linux Enterprise Module for Public Cloud 15-SP4
• SUSE Linux Enterprise Server 12-SP3-BCL
• SUSE Linux Enterprise Server 12-SP4
• SUSE Linux Enterprise Server 12-SP4-LTSS
• SUSE Linux Enterprise Server 12-SP5
• SUSE Linux Enterprise Server 15-SP2
• SUSE Linux Enterprise Server 15-SP3
• SUSE Linux Enterprise Server 15-SP4
• SUSE Linux Enterprise Server for SAP 12-SP4
• SUSE Linux Enterprise Server for SAP Applications 12-SP5
• SUSE Linux Enterprise Server for SAP Applications 15-SP2
• SUSE Linux Enterprise Server for SAP Applications 15-SP3
• SUSE Linux Enterprise Server for SAP Applications 15-SP4
• SUSE Linux Enterprise Software Development Kit 12-SP5
• SUSE Linux Enterprise Storage 7.1
• SUSE Linux Enterprise Workstation Extension 12-SP5
• SUSE Manager Proxy 4.2
• SUSE Manager Proxy 4.3
• SUSE Manager Retail Branch Server 4.2
• SUSE Manager Retail Branch Server 4.3
• SUSE Manager Server 4.2
• SUSE Manager Server 4.3
• SUSE OpenStack Cloud 9
• SUSE OpenStack Cloud Crowbar 9
• Ubuntu 14.04 ESM
• Ubuntu 16.04 ESM 
• Ubuntu 18.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 22.04 LTS
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

For SUSE

Apply fixes issued by the vendor:

• https://www.suse.com/support/update/announcement/2022/suse-su-20223584-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223585-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223586-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223587-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223599-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223601-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223605-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223606-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223607-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223609-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223628-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223648-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223657-1/

 

For Ubuntu

Apply fixes issued by the vendor:

• https://ubuntu.com/security/notices/USN-5682-1
• https://ubuntu.com/security/notices/USN-5683-1
• https://ubuntu.com/security/notices/USN-5684-1
• https://ubuntu.com/security/notices/USN-5687-1
• https://ubuntu.com/security/notices/USN-5691-1
• https://ubuntu.com/security/notices/USN-5692-1
• https://ubuntu.com/security/notices/USN-5693-1

 

For Redhat

Apply fixes issued by the vendor:

• https://access.redhat.com/errata/RHSA-2022:6978
• https://access.redhat.com/errata/RHSA-2022:6983
• https://access.redhat.com/errata/RHSA-2022:6991

---

Vulnerability Identifier

• CVE-2016-3695
• CVE-2020-16119
• CVE-2020-27784
• CVE-2020-36516
• CVE-2021-4155
• CVE-2021-4159
• CVE-2021-4203
• CVE-2021-33655
• CVE-2021-39698
• CVE-2021-45485
• CVE-2021-45486
• CVE-2022-0812
• CVE-2022-1012
• CVE-2022-1263
• CVE-2022-1882
• CVE-2022-2318
• CVE-2022-2503
• CVE-2022-2586
• CVE-2022-2588
• CVE-2022-2602
• CVE-2022-2639
• CVE-2022-2663
• CVE-2022-2905
• CVE-2022-2977
• CVE-2022-2978
• CVE-2022-3028
• CVE-2022-3176
• CVE-2022-3202
• CVE-2022-3239
• CVE-2022-3303
• CVE-2022-20008
• CVE-2022-20368
• CVE-2022-20369
• CVE-2022-21123
• CVE-2022-21125
• CVE-2022-21166
• CVE-2022-26365
• CVE-2022-26373
• CVE-2022-32296
• CVE-2022-33740
• CVE-2022-33741
• CVE-2022-33742
• CVE-2022-33743
• CVE-2022-33744
• CVE-2022-34494
• CVE-2022-34495
• CVE-2022-36879
• CVE-2022-36946
• CVE-2022-39188
• CVE-2022-39189
• CVE-2022-39190
• CVE-2022-40768
• CVE-2022-41218
• CVE-2022-41222
• CVE-2022-41674
• CVE-2022-41848
• CVE-2022-41849
• CVE-2022-42719
• CVE-2022-42720
• CVE-2022-42721
• CVE-2022-42722

---

Source

• AusCERT
• Ubuntu
• SUSE
• Redhat

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2022.5120
• https://www.auscert.org.au/bulletins/ESB-2022.5122
• https://www.auscert.org.au/bulletins/ESB-2022.5123
• https://www.auscert.org.au/bulletins/ESB-2022.5124
• https://www.auscert.org.au/bulletins/ESB-2022.5125
• https://www.auscert.org.au/bulletins/ESB-2022.5127
• https://www.auscert.org.au/bulletins/ESB-2022.5130
• https://www.auscert.org.au/bulletins/ESB-2022.5136
• https://www.auscert.org.au/bulletins/ESB-2022.5158
• https://www.auscert.org.au/bulletins/ESB-2022.5160
• https://www.auscert.org.au/bulletins/ESB-2022.5161
• https://www.auscert.org.au/bulletins/ESB-2022.5164
• https://www.auscert.org.au/bulletins/ESB-2022.5166
• https://www.suse.com/support/update/announcement/2022/suse-su-20223584-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223585-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223586-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223587-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223599-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223601-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223605-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223606-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223607-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223609-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223628-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223648-1/
• https://www.suse.com/support/update/announcement/2022/suse-su-20223657-1/
• https://ubuntu.com/security/notices/USN-5682-1
• https://ubuntu.com/security/notices/USN-5683-1
• https://ubuntu.com/security/notices/USN-5684-1
• https://ubuntu.com/security/notices/USN-5687-1
• https://ubuntu.com/security/notices/USN-5691-1
• https://ubuntu.com/security/notices/USN-5692-1
• https://ubuntu.com/security/notices/USN-5693-1
• https://access.redhat.com/errata/RHSA-2022:6978
• https://access.redhat.com/errata/RHSA-2022:6983
• https://access.redhat.com/errata/RHSA-2022:6991

甲骨文產品多個漏洞

發佈日期: 2022年10月19日

風險: 中度風險

類型: 伺服器 - 數據庫伺服器

於甲骨文產品發現多個漏洞，遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行程式碼、繞過保安限制、洩露敏感資料及資料篡改。

---

影響

• 阻斷服務
• 遠端執行程式碼
• 繞過保安限制
• 資料洩露
• 篡改

---

受影響之系統或技術

• Oracle MySQL
• Java SE
• Oracle Database Server
• VirtualBox

 

有關其他 甲骨文 產品，請參閱以下連結:

https://www.oracle.com/security-alerts/cpuoct2022.html

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

甲骨文 Critical Patch Update Advisory

---

漏洞識別碼

• https://www.oracle.com/security-alerts/cpuoct2022verbose.html

---

資料來源

• Oracle

---

相關連結

• https://www.oracle.com/security-alerts/cpuoct2022.html

Oracle Products Multiple Vulnerabilities

Release Date: 19 Oct 2022

RISK: Medium Risk

TYPE: Servers - Database Servers

Multiple vulnerabilities were identified in Oracle Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, security restriction bypass, sensitive information disclosure and data manipulation on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure
• Data Manipulation

---

System / Technologies affected

• Oracle MySQL
• Java SE
• Oracle Database Server
• VirtualBox

 

For other Oracle products, please refer to the link below:

https://www.oracle.com/security-alerts/cpuoct2022.html

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

Oracle Critical Patch Update Advisory

---

Vulnerability Identifier

• https://www.oracle.com/security-alerts/cpuoct2022verbose.html

---

Source

• Oracle

---

Related Link

• https://www.oracle.com/security-alerts/cpuoct2022.html

Apache Commons Text 遠端執行程式碼漏洞

發佈日期: 2022年10月18日

風險: 高度風險

類型: 伺服器 - 網站伺服器

於 Apache Commons Text 發現一個漏洞，遠端使用者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼。

 

注意：CVE-2022-42889 的概念驗證碼已被公開

---

影響

• 遠端執行程式碼

---

受影響之系統或技術

• Apache Commons Text 1.10.0 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• Apache Commons Text 1.10.0 或之後版本

---

漏洞識別碼

• CVE-2022-42889

---

資料來源

• Apache

---

相關連結

• https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om

Apache Commons Text Remote Code Execution Vulnerabilities

Release Date: 18 Oct 2022

RISK: High Risk

TYPE: Servers - Web Servers

A vulnerability has been identified in Apache Commons Text. A remote user can exploit some of these vulnerabilities to trigger remote code execution on the targeted system. 

 

Notes: Proof Of Concept Exploit Code Is Publicly Available for CVE-2022-42889

---

Impact

• Remote Code Execution

---

System / Technologies affected

• Apache Commons Text prior to 1.10.0

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• Apache Commons Text 1.10.0 or later

---

Vulnerability Identifier

• CVE-2022-42889

---

Source

• Apache

---

Related Link

• https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om