風險: 中度風險
類型: 操作系統 - 其他操作系統
於 ChromeOS 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、遠端執行任意程式碼及繞過保安限制。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝供應商提供的修補程式，詳情請參閱以下連結：
RISK: Medium Risk
TYPE: Operating Systems - Others OS
Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor. For detail, please refer to the link below:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Google Chrome 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 高度風險
類型: 操作系統 - 視窗操作系統
微軟已為產品提供本月保安更新：
| 受影響產品 | 風險程度 | 影響 | 備註 |
| 瀏覽器 |  中度風險 | 遠端執行程式碼 權限提升 仿冒 | |
| Azure | 中度風險 | 遠端執行程式碼 資料洩露 繞過保安限制 | |
| 視窗 |  高度風險 | 權限提升 資料洩露 遠端執行程式碼 阻斷服務 仿冒 繞過保安限制 | CVE-2023-36025 正被廣泛利用。 此漏洞允許惡意網路捷徑繞過安全檢查和警告。
CVE-2023-36033 正被廣泛利用。此漏洞可被利用以獲得 SYSTEM 權限。
CVE-2023-36036 正被廣泛利用。此漏洞可被利用以獲得 SYSTEM 權限。 |
| 延伸安全性更新 (ESU) | 高度風險 | 權限提升 資料洩露 遠端執行程式碼 阻斷服務 繞過保安限制 | CVE-2023-36025 正被廣泛利用。 此漏洞允許惡意網路捷徑繞過安全檢查和警告。
CVE-2023-36033 正被廣泛利用。此漏洞可被利用以獲得 SYSTEM 權限。
CVE-2023-36036 正被廣泛利用。此漏洞可被利用以獲得 SYSTEM 權限。 |
| 開發者工具 | 中度風險 | 繞過保安限制 權限提升 阻斷服務 仿冒 | |
| System Center | 中度風險 | 權限提升 資料洩露 | |
| 微軟 Office | 中度風險 | 繞過保安限制 遠端執行程式碼 | |
| 微軟 Dynamics |  低度風險 | 仿冒 | |
| Exchange Server | 中度風險 | 遠端執行程式碼 仿冒 | |
| Mariner | 低度風險 | 阻斷服務 |
「極高度風險」產品數目：0
「高度風險」產品數目：2
「中度風險」產品數目：6
「低度風險」產品數目：2
整體「風險程度」評估：高度風險
在安裝軟體之前，請先瀏覽軟體供應商之網站，以獲得更多詳細資料。
RISK: High Risk
TYPE: Operating Systems - Windows OS
Microsoft has released monthly security update for their products:
| Vulnerable Product | Risk Level | Impacts | Notes |
| Browser | Medium Risk | Remote Code Execution Elevation of Privilege Spoofing | |
| Azure | Medium Risk | Remote Code Execution Information Disclosure Security Restriction Bypass | |
| Windows | High Risk | Elevation of Privilege Information Disclosure Remote Code Execution Denial of Service Spoofing Security Restriction Bypass | CVE-2023-36025 is being exploited in the wild. The vulnerability allows a malicious internet shortcut to bypass secuirty checks and warnings.
CVE-2023-36033 is being exploited in the wild. The vulnerability can be expoloited to gain SYSTEM privileges.
CVE-2023-36036 is being exploited in the wild. The vulnerability can be exploited to gain SYSTEM privileges. |
Extended Security Updates (ESU) | High Risk | Elevation of Privilege Information Disclosure Remote Code Execution Denial of Service Security Restriction Bypass | CVE-2023-36025 is being exploited in the wild. The vulnerability allows a malicious internet shortcut to bypass secuirty checks and warnings.
CVE-2023-36033 is being exploited in the wild. The vulnerability can be expoloited to gain SYSTEM privileges.
CVE-2023-36036 is being exploited in the wild. The vulnerability can be exploited to gain SYSTEM privileges. |
| Developer Tools | Medium Risk | Security Restriction Bypass Elevation of Privilege Denial of Service Spoofing | |
| System Center | Medium Risk | Elevation of Privilege Information Disclosure | |
| Microsoft Office | Medium Risk | Security Restriction Bypass Remote Code Execution | |
| Microsoft Dynamics | Low Risk | Spoofing | |
| Exchange Server | Medium Risk | Remote Code Execution Spoofing | |
| Mariner | Low Risk | Denial of Service |
Number of 'Extremely High Risk' product(s): 0
Number of 'High Risk' product(s): 2
Number of 'Medium Risk' product(s): 6
Number of 'Low Risk' product(s): 2
Evaluation of overall 'Risk Level': High Risk
Before installation of the software, please visit the vendor web-site for more details.
RISK: Medium Risk
TYPE: Clients - Productivity Products
Multiple vulnerabilities were identified in SAP Products. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution, sensitive information disclosure, and security restriction bypass on the targeted system.
Please refer to the link below for detail:
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
RISK: Medium Risk
TYPE: Servers - Other Servers
A vulnerability was identified in a NetApp Product. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, sensitive information disclosure and data manipulation on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
RISK: Medium Risk
TYPE: Servers - Other Servers
Multiple vulnerabilities were identified in OpenVPN. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition and sensitive information disclosure on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution and denial of service condition on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 中度風險
類型: 操作系統 - 流動裝置及操作系統
於 Android 發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升及洩露敏感資料。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
RISK: Medium Risk
TYPE: Operating Systems - Mobile & Apps
Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and sensitive information disclosure on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
RISK: Medium Risk
TYPE: Operating Systems - Others OS
Multiple vulnerabilities were identified in ChromeOS. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution and security restriction bypass on the targeted system.
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor. For detail, please refer to the link below:
風險: 中度風險
類型: 用戶端 - 瀏覽器
於 Google Chrome 發現一個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發阻斷服務狀況、權限提升及遠端執行任意程式碼。
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
安裝軟件供應商提供的修補程式：
RISK: Medium Risk
TYPE: Clients - Browsers
A vulnerability has been identified in Google Chrome. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege and remote code execution on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
風險: 極高度風險
類型: 操作系統 - 流動裝置及操作系統
於三星產品發現多個漏洞。遠端攻擊者可利用這些漏洞，於目標系統觸發權限提升、遠端執行程式碼、阻斷服務、繞過保安限制、篡改及洩露敏感資料。
注意：
有跡象表明 CVE-2023-4863 及 CVE-2023-4211 正在被積極利用。
CVE-2023-4863： libwebp 中的堆緩衝區溢位。
CVE-2023-4211：本機非權限使用者可進行不當的 GPU 記憶體處理操作，以取得已釋放的記憶體。
有關受影響產品，請參閱以下連結:
https://security.samsungmobile.com/securityUpdate.smsb
在安裝軟體之前，請先瀏覽供應商之網站，以獲得更多詳細資料。
RISK: Extremely High Risk
TYPE: Operating Systems - Mobile & Apps
Multiple vulnerabilities were identified in Samsung Products. A remote attacker could exploit some of these vulnerabilities to trigger elevation of privilege, remote code execution, denial of service, security restriction bypass, data manipulation and sensitive information disclosure on the targeted system.
Note:
There are indications that CVE-2023-4863 and CVE-2023-4211 are under active exploitation in the wild.
CVE-2023-4863: Heap buffer overflow in libwebp.
CVE-2023-4211: A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
For affected products, please refer to the link below:
https://security.samsungmobile.com/securityUpdate.smsb
Before installation of the software, please visit the vendor web-site for more details.
RISK: Medium Risk
TYPE: Clients - Browsers
Multiple vulnerabilities were identified in Microsoft Edge. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution and spoofing on the targeted system.
Before installation of the software, please visit the software vendor web-site for more details.
Apply fixes issued by the vendor:
