Mozilla Products Multiple Vulnerabilities

Release Date: 12 Apr 2023

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Mozilla Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, spoofing, remote code execution, sensitive information disclosure and security restriction bypass on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Information Disclosure
• Security Restriction Bypass
• Spoofing

---

System / Technologies affected

Versions prior to:

 

• Firefox 112
• Firefox for Android 112
• Focus for Android 112
• Firefox ESR 102.10
• Thunderbird 102.10

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• Firefox 112
• Firefox for Android 112
• Focus for Android 112
• Firefox ESR 102.10
• Thunderbird 102.10

---

Vulnerability Identifier

• CVE-2023-0547
• CVE-2023-1945
• CVE-2023-29479
• CVE-2023-29531
• CVE-2023-29532
• CVE-2023-29533
• CVE-2023-29534
• CVE-2023-29535
• CVE-2023-29536
• CVE-2023-29537
• CVE-2023-29538
• CVE-2023-29539
• CVE-2023-29540
• CVE-2023-29541
• CVE-2023-29542
• CVE-2023-29543
• CVE-2023-29544
• CVE-2023-29545
• CVE-2023-29546
• CVE-2023-29547
• CVE-2023-29548
• CVE-2023-29549
• CVE-2023-29550
• CVE-2023-29551

---

Source

• Mozilla

---

Related Link

• https://www.mozilla.org/en-US/security/advisories/mfsa2023-13/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-14/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-15/

蘋果產品遠端執行任意程式碼漏洞

發佈日期: 2023年04月11日

風險: 極高度風險

類型: 操作系統 - 流動裝置及操作系統

於蘋果產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼。

 

注意:

CVE-2023-28205 及 CVE-2023-28205 漏洞正被廣泛利用。這些漏洞與WebKit元件有關，當元件處理惡意構造的網頁內容時 ，可能會導致執行任意程式碼。

 

---

影響

• 遠端執行程式碼

---

受影響之系統或技術

• iOS 15.7.5 以前的版本
• iOS 16.4.1 以前的版本
• iPadOS 15.7.5 以前的版本
• iPadOS 16.4.1 以前的版本
• macOS Big Sur 11.7.6 以前的版本
• macOS Monterey 12.6.5 以前的版本
• macOS Ventura 13.3.1 以前的版本
• Safari 16.4.1 以前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝供應商提供的修補程式：

 

• iOS 15.7.5
• iOS 16.4.1
• iPadOS 15.7.5
• iPadOS 16.4.1
• macOS Big Sur 11.7.6
• macOS Monterey 12.6.5
• macOS Ventura 13.3.1
• Safari 16.4.1

---

漏洞識別碼

• CVE-2023-28205
• CVE-2023-28206

---

資料來源

• Apple

---

相關連結

• https://support.apple.com/en-us/HT213720
• https://support.apple.com/en-us/HT213721
• https://support.apple.com/en-us/HT213722
• https://support.apple.com/en-us/HT213723
• https://support.apple.com/en-us/HT213724
• https://support.apple.com/en-us/HT213725

Apple Products Remote Code Execution Vulnerabilities

Release Date: 11 Apr 2023

RISK: Extremely High Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Apple Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution on the targeted system.

 

Note:

CVE-2023-28205 and CVE-2023-28206 are being exploited in the wild. These vulnerabilities are related to the WebKit component when processing maliciously crafted web content that may lead to arbitrary code execution. 

---

Impact

• Remote Code Execution

---

System / Technologies affected

• Versions prior to iOS 15.7.5
• Versions prior to iOS 16.4.1
• Versions prior to iPadOS 15.7.5
• Versions prior to iPadOS 16.4.1
• Versions prior to macOS Big Sur 11.7.6
• Versions prior to macOS Monterey 12.6.5
• Versions prior to macOS Ventura 13.3.1
• Versions prior to Safari 16.4.1

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

 

• iOS 15.7.5
• iOS 16.4.1
• iPadOS 15.7.5
• iPadOS 16.4.1
• macOS Big Sur 11.7.6
• macOS Monterey 12.6.5
• macOS Ventura 13.3.1
• Safari 16.4.1

---

Vulnerability Identifier

• CVE-2023-28205
• CVE-2023-28206

---

Source

• Apple

---

Related Link

• https://support.apple.com/en-us/HT213720
• https://support.apple.com/en-us/HT213721
• https://support.apple.com/en-us/HT213722
• https://support.apple.com/en-us/HT213723
• https://support.apple.com/en-us/HT213724
• https://support.apple.com/en-us/HT213725

Microsoft Edge 多個漏洞

發佈日期: 2023年04月11日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Microsoft Edge 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼、繞過保安限制、洩露敏感資料、仿冒及資料篡改。

---

影響

• 遠端執行程式碼
• 繞過保安限制
• 資料洩露
• 仿冒
• 篡改

---

受影響之系統或技術

• Microsoft Edge 112.0.1722.34 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 112.0.1722.34 或之後版本

---

漏洞識別碼

• CVE-2023-1810
• CVE-2023-1811
• CVE-2023-1812
• CVE-2023-1813
• CVE-2023-1814
• CVE-2023-1815
• CVE-2023-1816
• CVE-2023-1817
• CVE-2023-1818
• CVE-2023-1819
• CVE-2023-1820
• CVE-2023-1821
• CVE-2023-1822
• CVE-2023-1823
• CVE-2023-24935
• CVE-2023-28284
• CVE-2023-28301

---

資料來源

• Microsoft Edge

---

相關連結

• https://msrc.microsoft.com/update-guide/vulnerability/
• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-6-2023

Microsoft Edge Multiple Vulnerabilities

Release Date: 11 Apr 2023

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, security restriction bypass, sensitive information disclosure, spoofing and data manipulation on the targeted system.

---

Impact

• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure
• Spoofing
• Data Manipulation

---

System / Technologies affected

• Microsoft Edge prior to 112.0.1722.34

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 112.0.1722.34 or later

---

Vulnerability Identifier

• CVE-2023-1810
• CVE-2023-1811
• CVE-2023-1812
• CVE-2023-1813
• CVE-2023-1814
• CVE-2023-1815
• CVE-2023-1816
• CVE-2023-1817
• CVE-2023-1818
• CVE-2023-1819
• CVE-2023-1820
• CVE-2023-1821
• CVE-2023-1822
• CVE-2023-1823
• CVE-2023-24935
• CVE-2023-28284
• CVE-2023-28301

---

Source

• Microsoft Edge

---

Related Link

• https://msrc.microsoft.com/update-guide/vulnerability/
• https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-6-2023

Ubuntu Linux 核心多個漏洞

發佈日期: 2023年04月11日

風險: 中度風險

類型: 操作系統 - LINUX

於 Ubuntu Products 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼、繞過保安限制及洩露敏感資料。

---

影響

• 阻斷服務
• 遠端執行程式碼
• 繞過保安限制
• 資料洩露

---

受影響之系統或技術

• Ubuntu 16.04 ESM
• Ubuntu 20.04 LTS

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://ubuntu.com/security/notices/USN-6000-1
• https://ubuntu.com/security/notices/USN-6001-1

---

漏洞識別碼

• CVE-2020-36516
• CVE-2021-3428
• CVE-2021-3659
• CVE-2021-3669
• CVE-2021-3732
• CVE-2021-3772
• CVE-2021-4149
• CVE-2021-4203
• CVE-2021-26401
• CVE-2021-28712
• CVE-2021-28713
• CVE-2021-45868
• CVE-2022-0487
• CVE-2022-0494
• CVE-2022-0617
• CVE-2022-1016
• CVE-2022-1195
• CVE-2022-1205
• CVE-2022-1462
• CVE-2022-1516
• CVE-2022-1974
• CVE-2022-1975
• CVE-2022-2318
• CVE-2022-2380
• CVE-2022-2503
• CVE-2022-2663
• CVE-2022-2991
• CVE-2022-3061
• CVE-2022-3111
• CVE-2022-3169
• CVE-2022-3303
• CVE-2022-3424
• CVE-2022-3435
• CVE-2022-3521
• CVE-2022-3545
• CVE-2022-3623
• CVE-2022-3628
• CVE-2022-3646
• CVE-2022-3903
• CVE-2022-4139
• CVE-2022-4662
• CVE-2022-20132
• CVE-2022-20572
• CVE-2022-36280
• CVE-2022-36879
• CVE-2022-39188
• CVE-2022-41218
• CVE-2022-41849
• CVE-2022-41850
• CVE-2022-42328
• CVE-2022-42329
• CVE-2022-47520
• CVE-2022-47929
• CVE-2023-0045
• CVE-2023-0266
• CVE-2023-0394
• CVE-2023-0461
• CVE-2023-1074
• CVE-2023-1095
• CVE-2023-1118
• CVE-2023-1382
• CVE-2023-20938
• CVE-2023-23454
• CVE-2023-23455
• CVE-2023-26545
• CVE-2023-26607
• CVE-2023-28328

---

資料來源

• Ubuntu
• AusCERT

---

相關連結

• https://ubuntu.com/security/notices/USN-6000-1
• https://ubuntu.com/security/notices/USN-6001-1
• https://www.auscert.org.au/bulletins/ESB-2023.2009
• https://www.auscert.org.au/bulletins/ESB-2023.2011

Ubuntu Linux Kernel Multiple Vulnerabilities

Release Date: 11 Apr 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in Ubuntu Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, security restriction bypass and sensitive information disclosure on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

---

System / Technologies affected

• Ubuntu 16.04 ESM
• Ubuntu 20.04 LTS

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://ubuntu.com/security/notices/USN-6000-1
• https://ubuntu.com/security/notices/USN-6001-1

---

Vulnerability Identifier

• CVE-2020-36516
• CVE-2021-3428
• CVE-2021-3659
• CVE-2021-3669
• CVE-2021-3732
• CVE-2021-3772
• CVE-2021-4149
• CVE-2021-4203
• CVE-2021-26401
• CVE-2021-28712
• CVE-2021-28713
• CVE-2021-45868
• CVE-2022-0487
• CVE-2022-0494
• CVE-2022-0617
• CVE-2022-1016
• CVE-2022-1195
• CVE-2022-1205
• CVE-2022-1462
• CVE-2022-1516
• CVE-2022-1974
• CVE-2022-1975
• CVE-2022-2318
• CVE-2022-2380
• CVE-2022-2503
• CVE-2022-2663
• CVE-2022-2991
• CVE-2022-3061
• CVE-2022-3111
• CVE-2022-3169
• CVE-2022-3303
• CVE-2022-3424
• CVE-2022-3435
• CVE-2022-3521
• CVE-2022-3545
• CVE-2022-3623
• CVE-2022-3628
• CVE-2022-3646
• CVE-2022-3903
• CVE-2022-4139
• CVE-2022-4662
• CVE-2022-20132
• CVE-2022-20572
• CVE-2022-36280
• CVE-2022-36879
• CVE-2022-39188
• CVE-2022-41218
• CVE-2022-41849
• CVE-2022-41850
• CVE-2022-42328
• CVE-2022-42329
• CVE-2022-47520
• CVE-2022-47929
• CVE-2023-0045
• CVE-2023-0266
• CVE-2023-0394
• CVE-2023-0461
• CVE-2023-1074
• CVE-2023-1095
• CVE-2023-1118
• CVE-2023-1382
• CVE-2023-20938
• CVE-2023-23454
• CVE-2023-23455
• CVE-2023-26545
• CVE-2023-26607
• CVE-2023-28328

---

Source

• Ubuntu
• AusCERT

---

Related Link

• https://ubuntu.com/security/notices/USN-6000-1
• https://ubuntu.com/security/notices/USN-6001-1
• https://www.auscert.org.au/bulletins/ESB-2023.2009
• https://www.auscert.org.au/bulletins/ESB-2023.2011

Android多個漏洞

發佈日期: 2023年04月06日

風險: 中度風險

類型: 操作系統 - 流動裝置及操作系統

於 Android 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升、洩露敏感資料及遠端執行程式碼。

 

---

影響

• 阻斷服務
• 權限提升
• 資料洩露
• 遠端執行程式碼

---

受影響之系統或技術

• 2023-04-05 前的 Android 保安更新級別

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

• 安裝軟件供應商提供的修補程式：
  https://source.android.com/docs/security/bulletin/2023-04-01

---

漏洞識別碼

• CVE-2021-0872
• CVE-2021-0873
• CVE-2021-0874
• CVE-2021-0875
• CVE-2021-0876
• CVE-2021-0878
• CVE-2021-0879
• CVE-2021-0880
• CVE-2021-0881
• CVE-2021-0882
• CVE-2021-0883
• CVE-2021-0884
• CVE-2021-0885
• CVE-2022-4696
• CVE-2022-20463
• CVE-2022-20471
• CVE-2022-32599
• CVE-2022-33231
• CVE-2022-33269
• CVE-2022-33270
• CVE-2022-33288
• CVE-2022-33289
• CVE-2022-33302
• CVE-2022-33917
• CVE-2022-36449
• CVE-2022-38181
• CVE-2022-40503
• CVE-2022-40532
• CVE-2022-41757
• CVE-2022-42716
• CVE-2022-47335
• CVE-2022-47336
• CVE-2022-47337
• CVE-2022-47338
• CVE-2023-20652
• CVE-2023-20653
• CVE-2023-20654
• CVE-2023-20655
• CVE-2023-20656
• CVE-2023-20657
• CVE-2023-20909
• CVE-2023-20935
• CVE-2023-20941
• CVE-2023-20950
• CVE-2023-20967
• CVE-2023-21080
• CVE-2023-21081
• CVE-2023-21082
• CVE-2023-21083
• CVE-2023-21084
• CVE-2023-21085
• CVE-2023-21086
• CVE-2023-21087
• CVE-2023-21088
• CVE-2023-21089
• CVE-2023-21090
• CVE-2023-21091
• CVE-2023-21092
• CVE-2023-21093
• CVE-2023-21094
• CVE-2023-21096
• CVE-2023-21097
• CVE-2023-21098
• CVE-2023-21099
• CVE-2023-21100
• CVE-2023-21630

---

資料來源

• Android

---

相關連結

• https://source.android.com/docs/security/bulletin/2023-04-01

Android Multiple Vulnerabilities

Release Date: 6 Apr 2023

RISK: Medium Risk

TYPE: Operating Systems - Mobile & Apps

Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and sensitive information disclosure and remote code execution on the targeted system.

---

Impact

• Denial of Service
• Elevation of Privilege
• Information Disclosure
• Remote Code Execution

---

System / Technologies affected

• Android security patch level prior to 2023-04-05

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Apply fixes issued by the vendor:
  https://source.android.com/docs/security/bulletin/2023-04-01

---

Vulnerability Identifier

• CVE-2021-0872
• CVE-2021-0873
• CVE-2021-0874
• CVE-2021-0875
• CVE-2021-0876
• CVE-2021-0878
• CVE-2021-0879
• CVE-2021-0880
• CVE-2021-0881
• CVE-2021-0882
• CVE-2021-0883
• CVE-2021-0884
• CVE-2021-0885
• CVE-2022-4696
• CVE-2022-20463
• CVE-2022-20471
• CVE-2022-32599
• CVE-2022-33231
• CVE-2022-33269
• CVE-2022-33270
• CVE-2022-33288
• CVE-2022-33289
• CVE-2022-33302
• CVE-2022-33917
• CVE-2022-36449
• CVE-2022-38181
• CVE-2022-40503
• CVE-2022-40532
• CVE-2022-41757
• CVE-2022-42716
• CVE-2022-47335
• CVE-2022-47336
• CVE-2022-47337
• CVE-2022-47338
• CVE-2023-20652
• CVE-2023-20653
• CVE-2023-20654
• CVE-2023-20655
• CVE-2023-20656
• CVE-2023-20657
• CVE-2023-20909
• CVE-2023-20935
• CVE-2023-20941
• CVE-2023-20950
• CVE-2023-20967
• CVE-2023-21080
• CVE-2023-21081
• CVE-2023-21082
• CVE-2023-21083
• CVE-2023-21084
• CVE-2023-21085
• CVE-2023-21086
• CVE-2023-21087
• CVE-2023-21088
• CVE-2023-21089
• CVE-2023-21090
• CVE-2023-21091
• CVE-2023-21092
• CVE-2023-21093
• CVE-2023-21094
• CVE-2023-21096
• CVE-2023-21097
• CVE-2023-21098
• CVE-2023-21099
• CVE-2023-21100
• CVE-2023-21630

---

Source

• Android

---

Related Link

• https://source.android.com/docs/security/bulletin/2023-04-01

思科Webex會議介面漏洞

發佈日期: 2023年04月06日

風險: 中度風險

類型: 保安軟件及應用設備 - 保安軟件及應用設備

於思科Webex會議介面發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發跨網站指令碼、篡改、遠端執行程式碼及資料洩露。

 

---

影響

• 篡改
• 遠端執行程式碼
• 資料洩露
• 跨網站指令碼

---

受影響之系統或技術

• Cisco Webex Meetings

 

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wbx-sxss-fupl-64uHbcm5

 

---

漏洞識別碼

• CVE-2023-20132
• CVE-2023-20134

---

資料來源

• Cisco

---

相關連結

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wbx-sxss-fupl-64uHbcm5

Cisco Webex Meetings Web UI Vulnerabilities

Release Date: 6 Apr 2023

RISK: Medium Risk

TYPE: Security software and application - Security Software & Appliance

Multiple vulnerabilities were identified in Cisco Webex Meetings Web UI. A remote attacker could exploit some of these vulnerabilities to trigger cross-site scripting, data manipulation, remote code execution and information disclosure on the targeted system.

---

Impact

• Data Manipulation
• Remote Code Execution
• Information Disclosure
• Cross-Site Scripting

---

System / Technologies affected

• Cisco Webex Meetings

 

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wbx-sxss-fupl-64uHbcm5

 

---

Vulnerability Identifier

• CVE-2023-20132
• CVE-2023-20134

---

Source

• Cisco

---

Related Link

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wbx-sxss-fupl-64uHbcm5

Google Chrome 多個漏洞

發佈日期: 2023年04月06日

風險: 中度風險

類型: 用戶端 - 瀏覽器

於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發篡改、遠端執行程式碼及資料洩露。

 

---

影響

• 遠端執行程式碼
• 篡改
• 資料洩露

---

受影響之系統或技術

• Google Chrome 112.0.5615.49 (Linux) 之前的版本
• Google Chrome 112.0.5615.49 (Mac) 之前的版本
• Google Chrome 112.0.5615.49/50 (Windows) 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

安裝軟件供應商提供的修補程式：

• 更新至 112.0.5615.49 (Linux) 或之後版本
• 更新至 112.0.5615.49 (Mac) 或之後版本
• 更新至 112.0.5615.49/50 (Windows) 或之後版本

---

漏洞識別碼

• CVE-2023-1810
• CVE-2023-1811
• CVE-2023-1812
• CVE-2023-1813
• CVE-2023-1814
• CVE-2023-1815
• CVE-2023-1816
• CVE-2023-1817
• CVE-2023-1818
• CVE-2023-1819
• CVE-2023-1820
• CVE-2023-1821
• CVE-2023-1822
• CVE-2023-1823

---

資料來源

• Google Chrome

---

相關連結

• https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html

Google Chrome Multiple Vulnerabilities

Release Date: 6 Apr 2023

RISK: Medium Risk

TYPE: Clients - Browsers

Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger data manipulation, remote code execution and information disclosure on the targeted system.

---

Impact

• Remote Code Execution
• Data Manipulation
• Information Disclosure

---

System / Technologies affected

• Google Chrome prior to 112.0.5615.49 (Linux)
• Google Chrome prior to 112.0.5615.49 (Mac)
• Google Chrome prior to 112.0.5615.49/50 (Windows)

---

Solutions

Before installation of the software, please visit the software vendor web-site for more details.

Apply fixes issued by the vendor:

• Update to version 112.0.5615.49 (Linux) or later
• Update to version 112.0.5615.49 (Mac) or later
• Update to version 112.0.5615.49/50 (Windows) or later

---

Vulnerability Identifier

• CVE-2023-1810
• CVE-2023-1811
• CVE-2023-1812
• CVE-2023-1813
• CVE-2023-1814
• CVE-2023-1815
• CVE-2023-1816
• CVE-2023-1817
• CVE-2023-1818
• CVE-2023-1819
• CVE-2023-1820
• CVE-2023-1821
• CVE-2023-1822
• CVE-2023-1823

---

Source

• Google Chrome

---

Related Link

• https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html

RedHat Linux 核心多個漏洞

發佈日期: 2023年04月06日

風險: 中度風險

類型: 操作系統 - LINUX

於 RedHat Linux 核心發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升、遠端執行任意程式碼及洩露敏感資料。

 

---

影響

• 遠端執行程式碼
• 權限提升
• 資料洩露

---

受影響之系統或技術

• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat Enterprise Linux Server - AUS 8.2 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.2 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.2 x86_64
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time 8 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.2 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Virtualization Host 4 for RHEL 8 x86_64

 

---

解決方案

在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。

 

安裝供應商提供的修補程式：

• https://access.redhat.com/errata/RHSA-2023:1588
• https://access.redhat.com/errata/RHSA-2023:1584
• https://access.redhat.com/errata/RHSA-2023:1566
• https://access.redhat.com/errata/RHSA-2023:1560
• https://access.redhat.com/errata/RHSA-2023:1559
• https://access.redhat.com/errata/RHSA-2023:1557
• https://access.redhat.com/errata/RHSA-2023:1556
• https://access.redhat.com/errata/RHSA-2023:1554

---

漏洞識別碼

• CVE-2022-3564
• CVE-2022-4269
• CVE-2022-4378
• CVE-2023-0266
• CVE-2023-0386
• CVE-2023-0461

---

資料來源

• AusCERT
• Redhat

---

相關連結

• https://www.auscert.org.au/bulletins/ESB-2023.1969
• https://www.auscert.org.au/bulletins/ESB-2023.1967
• https://www.auscert.org.au/bulletins/ESB-2023.1963
• https://www.auscert.org.au/bulletins/ESB-2023.1962
• https://www.auscert.org.au/bulletins/ESB-2023.1961
• https://www.auscert.org.au/bulletins/ESB-2023.1960
• https://www.auscert.org.au/bulletins/ESB-2023.1959
• https://www.auscert.org.au/bulletins/ESB-2023.1958
• https://access.redhat.com/errata/RHSA-2023:1588
• https://access.redhat.com/errata/RHSA-2023:1584
• https://access.redhat.com/errata/RHSA-2023:1566
• https://access.redhat.com/errata/RHSA-2023:1560
• https://access.redhat.com/errata/RHSA-2023:1559
• https://access.redhat.com/errata/RHSA-2023:1557
• https://access.redhat.com/errata/RHSA-2023:1556
• https://access.redhat.com/errata/RHSA-2023:1554

RedHat Linux Kernel Multiple Vulnerabilities

Release Date: 6 Apr 2023

RISK: Medium Risk

TYPE: Operating Systems - Linux

Multiple vulnerabilities were identified in RedHat Linux Kernel. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

---

Impact

• Remote Code Execution
• Elevation of Privilege
• Information Disclosure

---

System / Technologies affected

• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat Enterprise Linux Server - AUS 8.2 x86_64
• Red Hat Enterprise Linux Server - AUS 8.4 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux Server - TUS 8.2 x86_64
• Red Hat Enterprise Linux Server - TUS 8.4 x86_64
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.2 x86_64
• Red Hat Enterprise Linux for Real Time - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time 8 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.2 x86_64
• Red Hat Enterprise Linux for Real Time for NFV - Telecommunications Update Service 8.4 x86_64
• Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.1 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Virtualization Host 4 for RHEL 8 x86_64

 

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

 

Apply fixes issued by the vendor:

• https://access.redhat.com/errata/RHSA-2023:1588
• https://access.redhat.com/errata/RHSA-2023:1584
• https://access.redhat.com/errata/RHSA-2023:1566
• https://access.redhat.com/errata/RHSA-2023:1560
• https://access.redhat.com/errata/RHSA-2023:1559
• https://access.redhat.com/errata/RHSA-2023:1557
• https://access.redhat.com/errata/RHSA-2023:1556
• https://access.redhat.com/errata/RHSA-2023:1554

---

Vulnerability Identifier

• CVE-2022-3564
• CVE-2022-4269
• CVE-2022-4378
• CVE-2023-0266
• CVE-2023-0386
• CVE-2023-0461

---

Source

• AusCERT
• Redhat

---

Related Link

• https://www.auscert.org.au/bulletins/ESB-2023.1969
• https://www.auscert.org.au/bulletins/ESB-2023.1967
• https://www.auscert.org.au/bulletins/ESB-2023.1963
• https://www.auscert.org.au/bulletins/ESB-2023.1962
• https://www.auscert.org.au/bulletins/ESB-2023.1961
• https://www.auscert.org.au/bulletins/ESB-2023.1960
• https://www.auscert.org.au/bulletins/ESB-2023.1959
• https://www.auscert.org.au/bulletins/ESB-2023.1958
• https://access.redhat.com/errata/RHSA-2023:1588
• https://access.redhat.com/errata/RHSA-2023:1584
• https://access.redhat.com/errata/RHSA-2023:1566
• https://access.redhat.com/errata/RHSA-2023:1560
• https://access.redhat.com/errata/RHSA-2023:1559
• https://access.redhat.com/errata/RHSA-2023:1557
• https://access.redhat.com/errata/RHSA-2023:1556
• https://access.redhat.com/errata/RHSA-2023:1554

Apple Xcode 多個漏洞

發佈日期: 2023年04月03日

風險: 中度風險

類型: 用戶端 - 辦公室應用

於 蘋果Xcode 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發繞過保安限制、遠端執行任意程式碼及洩露敏感資料。

---

影響

• 遠端執行程式碼
• 資料洩露
• 繞過保安限制

---

受影響之系統或技術

• 14.3 之前的版本

---

解決方案

在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。

• 更新至版本 14.3

---

漏洞識別碼

• CVE-2023-27945
• CVE-2023-27967

---

資料來源

• Apple

---

相關連結

• https://support.apple.com/en-us/HT213679