Advisory Week


Week 41, 2024
National Cyber Awareness System
 
Oracle Releases Quarterly Critical Patch Update Advisory for October 2024
CISA Adds One Known Exploited Vulnerability to Catalog
CISA Releases Seven Industrial Control Systems Advisories
CISA, FBI, NSA, and International Partners Release Advisory on Iranian Cyber Actors Targeting Critical Infrastructure Organizations Using Brute Force
CISA and FBI Release Joint Guidance on Product Security Bad Practices for Public Comment
CISA Adds Three Known Exploited Vulnerabilities to Catalog
CISA Releases Two Industrial Control Systems Advisories
Guidance: Framing Software Component Transparency: Establishing a Common Software Bill of Materials (SBOM)
Mozilla Security Advisories
 
Security Vulnerabilities fixed in Firefox for iOS 131.2 mfsa2024-54
Security Vulnerability fixed in Firefox 131.0.3 mfsa2024-53
Ubuntu Security Notices
 
Linux kernel (Azure) vulnerabilities: USN-7069-2 / USN-7028-2 / USN-7076-1 / USN-7073-2 / USN-7074-1
OATH Toolkit vulnerability: USN-7059-2
Linux kernel vulnerabilities: USN-7073-1 / USN-7072-1 / USN-7069-1
Linux kernel vulnerability: USN-7071-1
Vim vulnerability: USN-7048-2
libarchive vulnerabilities: USN-7070-1
APR vulnerability: USN-7038-2
nano vulnerability: USN-7064-1
ImageMagick vulnerabilities: USN-7068-1
ConfigObj vulnerability: USN-7040-2
nginx vulnerability: USN-7014-3
PostgreSQL vulnerability: USN-6968-3
Python vulnerability: USN-7015-4
HAProxy vulnerability: USN-7067-1
Thunderbird vulnerability: USN-7066-1
Firefox vulnerability: USN-7065-1
Red Hat Security Advisory
 
Moderate: java-1.8.0-openjdk security update: RHSA-2024:8116 / RHSA-2024:8117
Important: OpenShift Container Platform 4.13.z security update: RHSA-2024:7941
Important: OpenShift Container Platform 4.13.52 security update: RHSA-2024:7939
Moderate: OpenShift Container Platform 4.16.17 security update: RHSA-2024:7944
Moderate: OpenJDK 21.0.5 Security Update for Windows Builds: RHSA-2024:8129
Moderate: OpenJDK 21.0.5 Security Update for Portable Linux Builds: RHSA-2024:8128
Moderate: OpenJDK 17.0.13 Security Update for Windows Builds: RHSA-2024:8126
Moderate: OpenJDK 17.0.13 Security Update for Portable Linux Builds: RHSA-2024:8125
Moderate: OpenJDK 11.0.25 Security Update for Windows Builds: RHSA-2024:8123
Moderate: OpenJDK 11.0.25 Security Update for Portable Linux Builds: RHSA-2024:8122
Moderate: OpenJDK 8u432 Windows Security Update: RHSA-2024:8119
Moderate: OpenJDK 8u432 Security Update for Portable Linux Builds: RHSA-2024:8118
Moderate: java-17-openjdk security update: RHSA-2024:8124
Moderate: java-21-openjdk security update: RHSA-2024:8127
Important: webkit2gtk3 security update: RHSA-2024:8180
Important: resource-agents security update: RHSA-2024:8179 / RHSA-2024:8173 / RHSA-2024:8172
Moderate: java-11-openjdk security update: RHSA-2024:8121 / RHSA-2024:8120
Important: firefox security update: RHSA-2024:8176 / RHSA-2024:8167 / RHSA-2024:8131 / RHSA-2024:8034 / RHSA-2024:8033 / RHSA-2024:8032 / RHSA-2024:8031
Important: fence-agents security update: RHSA-2024:8171 / RHSA-2024:8170 / RHSA-2024:8168
Important: thunderbird security update: RHSA-2024:8169 / RHSA-2024:8166 / RHSA-2024:8030 / RHSA-2024:8029 / RHSA-2024:8028 / RHSA-2024:8027 / RHSA-2024:8026 / RHSA-2024:8025 / RHSA-2024:8024
Important: OpenShift Container Platform 4.17.1 bug fix and security update: RHSA-2024:7922
Moderate: Run Once Duration Override Operator for Red Hat OpenShift 1.2.0 for RHEL 9: RHSA-2024:7548
Moderate: kernel security update: RHSA-2024:8162 / RHSA-2024:8161 / RHSA-2024:8157 / RHSA-2024:8107
Moderate: kernel-rt security update: RHSA-2024:8158
Moderate: OpenShift Container Platform 4.17.1 packages and security update: RHSA-2024:7925
Moderate: OpenShift Container Platform 4.17.1 security and extras update: RHSA-2024:7921
Moderate: libuv security update: RHSA-2024:8132
Moderate: python3.9 security update: RHSA-2024:8130
Important: Red Hat OpenShift Data Foundation 4.16.3 security and bug fix update: RHSA-2024:8113
Important: skopeo security update: RHSA-2024:8111
Important: containernetworking-plugins security update: RHSA-2024:8110
Important: python-gevent security update: RHSA-2024:8105 / RHSA-2024:8102
Moderate: edk2 security update: RHSA-2024:8104
Moderate: python39:3.9 security update: RHSA-2024:8103
Important: Red Hat JBoss Enterprise Application Platform 7.4 security update: RHSA-2024:8093
Important: grafana security update: RHSA-2024:8083
Important: .NET 6.0 security update: RHSA-2024:8082 / RHSA-2024:8048 / RHSA-2024:8047 / RHSA-2024:8036
Moderate: OpenIPMI security update: RHSA-2024:8081 / RHSA-2024:8037
Important: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update: RHSA-2024:8080 / RHSA-2024:8077 / RHSA-2024:8076 / RHSA-2024:8075
Critical: Red Hat Build of Apache Camel 4.4.3 for Spring Boot security update.: RHSA-2024:8064
Moderate: Cluster Observability Operator 0.4.1: RHSA-2024:8040
Important: podman security update: RHSA-2024:8039
Important: container-tools:rhel8 security update: RHSA-2024:8038
Moderate: python3.11-urllib3 security update: RHSA-2024:8035
Important: Release of OpenShift Serverless Logic 1.34.0 security update & enhancements: RHSA-2024:8023
Cisco Security Advisory
 
Cisco ATA 190 Series Analog Telephone Adapter Firmware Vulnerabilities
Cisco UCS Central Software Configuration Backup Information Disclosure Vulnerability
Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability
Atlassian Security Advisories
 
Security Bulletin - October 15 2024
Microsoft Security
 
Microsoft October 2024 Security Update Guide
Chromium: CVE-2024-9955 Use after free in Web Authentication
Chromium: CVE-2024-9954 Use after free in AI
Chromium: CVE-2024-9958 Inappropriate implementation in PictureInPicture
Chromium: CVE-2024-9957 Use after free in UI
Chromium: CVE-2024-9956 Inappropriate implementation in Web Authentication
Chromium: CVE-2024-9961 Use after free in Parcel Tracking
Chromium: CVE-2024-9959 Use after free in DevTools
Chromium: CVE-2024-9960 Use after free in Dawn
Chromium: CVE-2024-9965 Insufficient data validation in DevTools
Google Security Advisories
 
Chrome Releases: Stable Channel Update for Desktop
Github Security Advisories
 
[GHSA-7vfh-cqpc-4267] Security Update for the OPC UA .NET Standard Stack
[GHSA-qm9f-c3v9-wphv] Security Update for the OPC UA .NET Standard Stack
[GHSA-p5wf-cmr4-xrwr] Permissive Regular Expression in tacquito
[GHSA-4qm4-8hg2-g2xm] MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow
[GHSA-crmj-qh74-2r36] Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
[GHSA-g9xm-7538-mq8w] Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder
[GHSA-7c4c-749j-pfp2] Admidio Vulnerable to HTML Injection In The Messages Section
[GHSA-h47h-mwp9-c6q6] Possible ReDoS vulnerability in block_format in Action Mailer
[GHSA-wwhv-wxv9-rpgw] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
[GHSA-vfg9-r3fq-jvx4] Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
[GHSA-x76w-6vjr-8xgj] Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
[GHSA-f96h-pmfr-66vw] Starlette Denial of service (DoS) via multipart/form-data
[GHSA-qcvh-p9jq-wp8v] Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
[GHSA-4jf8-g8wp-cx7c] Matrix JavaScript SDK's key history sharing could share keys to malicious devices
[GHSA-4r7v-whpg-8rx3] changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
[GHSA-r9mq-3c9r-fmjq] Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
[GHSA-2234-fmw7-43wr] Hano allows bypass of CSRF Middleware by a request without Content-Type header.
[GHSA-fmj7-7gfw-64pg] Agent Dart is missing certificate verification checks
[GHSA-cx95-q6gx-w4qp] SAK-50571 Sakai Kernel users created with type roleview can login as a normal user
[GHSA-pf5v-pqfv-x8jj] OpenCanary Executes Commands From Potentially Writable Config File
[GHSA-qh8g-58pp-2wxh] Eclipse Jetty URI parsing of invalid authority
[GHSA-g8m5-722r-8whq] Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
[GHSA-r7m4-f9h5-gr79] Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
[GHSA-3c32-4hq9-6wgj] SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
[GHSA-xmmm-jw76-q7vg] One Time Passcode (OTP) is valid longer than expiration timeSeverity
[GHSA-5rxp-2rhr-qwqv] Session fixation in Elytron SAML adapters
[GHSA-w8gr-xwp4-r9f7] Vulnerable Redirect URI Validation Results in Open Redirect
[GHSA-xgfv-xpx8-qhcr] Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
[GHSA-vv6c-69r6-chg9] Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly
[GHSA-m85w-3h95-hcf9] DOM Clobbering Gadget found in astro's client-side router that leads to XSS
[GHSA-g77x-44xx-532m] Denial of Service condition in Next.js image optimization
Drupal Security Advisories
 
Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
Spring Security Advisories
 
CVE-2024-38820 - Low - CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
CVE-2024-38819 - High - CVE-2024-38819: Path traversal vulnerability in functional web frameworks (2nd report)
CISA Known Exploted Vulnerabilities
 
SolarWinds Web Help Desk Hardcoded Credential Vulnerability CVE-2024-28987
Mozilla Firefox Use-After-Free Vulnerability CVE-2024-9680
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability CVE-2024-30088
Veeam Backup and Replication Deserialization Vulnerability CVE-2024-40711

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.