ISHACK AI BOT

Debian: CVE-2023-4352: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4352 CVE - 2023-4352 DSA-5479-1

Debian: CVE-2023-4353: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4353 CVE - 2023-4353 DSA-5479-1

Debian: CVE-2023-4363: chromium -- security update Severity 4 CVSS (AV:N/AC:M/Au:N/C:N/I:P/A:N) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4363 CVE - 2023-4363 DSA-5479-1

Debian: CVE-2023-4356: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4356 CVE - 2023-4356 DSA-5479-1

Debian: CVE-2023-4362: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4362 CVE - 2023-4362 DSA-5479-1

Debian: CVE-2023-4355: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4355 CVE - 2023-4355 DSA-5479-1

Debian: CVE-2023-4364: chromium -- security update Severity 4 CVSS (AV:N/AC:M/Au:N/C:N/I:P/A:N) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4364 CVE - 2023-4364 DSA-5479-1

Debian: CVE-2023-4354: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4354 CVE - 2023-4354 DSA-5479-1

Debian: CVE-2023-4365: chromium -- security update Severity 4 CVSS (AV:N/AC:M/Au:N/C:N/I:P/A:N) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4365 CVE - 2023-4365 DSA-5479-1

Debian: CVE-2023-4368: chromium -- security update Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4368 CVE - 2023-4368 DSA-5479-1

Debian: CVE-2023-4360: chromium -- security update Severity 4 CVSS (AV:N/AC:M/Au:N/C:N/I:P/A:N) Published 08/15/2023 Created 08/21/2023 Added 08/21/2023 Modified 01/28/2025 Description Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Solution(s) debian-upgrade-chromium References https://attackerkb.com/topics/cve-2023-4360 CVE - 2023-4360 DSA-5479-1

SUSE: CVE-2023-20197: SUSE Linux Security Advisory Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/16/2023 Created 08/28/2023 Added 08/28/2023 Modified 01/28/2025 Description A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . Solution(s) suse-upgrade-clamav suse-upgrade-clamav-devel suse-upgrade-libclamav9 suse-upgrade-libfreshclam2 References https://attackerkb.com/topics/cve-2023-20197 CVE - 2023-20197

Amazon Linux 2023: CVE-2023-20197: Important priority package update for clamav Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/16/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . Solution(s) amazon-linux-2023-upgrade-clamav amazon-linux-2023-upgrade-clamav-data amazon-linux-2023-upgrade-clamav-debuginfo amazon-linux-2023-upgrade-clamav-debugsource amazon-linux-2023-upgrade-clamav-devel amazon-linux-2023-upgrade-clamav-doc amazon-linux-2023-upgrade-clamav-filesystem amazon-linux-2023-upgrade-clamav-lib amazon-linux-2023-upgrade-clamav-lib-debuginfo amazon-linux-2023-upgrade-clamav-milter amazon-linux-2023-upgrade-clamav-milter-debuginfo amazon-linux-2023-upgrade-clamav-update amazon-linux-2023-upgrade-clamav-update-debuginfo amazon-linux-2023-upgrade-clamd amazon-linux-2023-upgrade-clamd-debuginfo References https://attackerkb.com/topics/cve-2023-20197 CVE - 2023-20197 https://alas.aws.amazon.com/AL2023/ALAS-2023-331.html

Ubuntu: USN-6388-1 (CVE-2023-4385): Linux kernel vulnerabilities Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 08/16/2023 Created 09/20/2023 Added 09/20/2023 Modified 01/28/2025 Description A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. Solution(s) ubuntu-upgrade-linux-image-4-4-0-1123-aws ubuntu-upgrade-linux-image-4-4-0-1124-kvm ubuntu-upgrade-linux-image-4-4-0-1161-aws ubuntu-upgrade-linux-image-4-4-0-245-generic ubuntu-upgrade-linux-image-4-4-0-245-lowlatency ubuntu-upgrade-linux-image-aws ubuntu-upgrade-linux-image-generic ubuntu-upgrade-linux-image-generic-lts-xenial ubuntu-upgrade-linux-image-kvm ubuntu-upgrade-linux-image-lowlatency ubuntu-upgrade-linux-image-lowlatency-lts-xenial ubuntu-upgrade-linux-image-virtual ubuntu-upgrade-linux-image-virtual-lts-xenial References https://attackerkb.com/topics/cve-2023-4385 CVE - 2023-4385 USN-6388-1

Debian: CVE-2023-4387: linux -- security update Severity 6 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:C) Published 08/16/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/30/2025 Description A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-4387 CVE - 2023-4387

Debian: CVE-2023-4385: linux -- security update Severity 5 CVSS (AV:L/AC:L/Au:S/C:N/I:N/A:C) Published 08/16/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-4385 CVE - 2023-4385

Amazon Linux AMI 2: CVE-2023-20197: Security patch for clamav (ALAS-2023-2233) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 08/16/2023 Created 09/08/2023 Added 09/08/2023 Modified 01/30/2025 Description A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . Solution(s) amazon-linux-ami-2-upgrade-clamav amazon-linux-ami-2-upgrade-clamav-data amazon-linux-ami-2-upgrade-clamav-debuginfo amazon-linux-ami-2-upgrade-clamav-devel amazon-linux-ami-2-upgrade-clamav-doc amazon-linux-ami-2-upgrade-clamav-filesystem amazon-linux-ami-2-upgrade-clamav-lib amazon-linux-ami-2-upgrade-clamav-milter amazon-linux-ami-2-upgrade-clamav-update amazon-linux-ami-2-upgrade-clamd References https://attackerkb.com/topics/cve-2023-20197 AL2/ALAS-2023-2233 CVE - 2023-20197

Debian: CVE-2023-4389: linux -- security update Severity 6 CVSS (AV:L/AC:L/Au:S/C:C/I:N/A:C) Published 08/16/2023 Created 07/31/2024 Added 07/30/2024 Modified 01/28/2025 Description A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information. Solution(s) debian-upgrade-linux References https://attackerkb.com/topics/cve-2023-4389 CVE - 2023-4389

Amazon Linux 2023: CVE-2023-39975: Medium priority package update for krb5 Severity 9 CVSS (AV:N/AC:L/Au:S/C:C/I:C/A:C) Published 08/16/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another. A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling. Solution(s) amazon-linux-2023-upgrade-krb5-debuginfo amazon-linux-2023-upgrade-krb5-debugsource amazon-linux-2023-upgrade-krb5-devel amazon-linux-2023-upgrade-krb5-libs amazon-linux-2023-upgrade-krb5-libs-debuginfo amazon-linux-2023-upgrade-krb5-pkinit amazon-linux-2023-upgrade-krb5-pkinit-debuginfo amazon-linux-2023-upgrade-krb5-server amazon-linux-2023-upgrade-krb5-server-debuginfo amazon-linux-2023-upgrade-krb5-server-ldap amazon-linux-2023-upgrade-krb5-server-ldap-debuginfo amazon-linux-2023-upgrade-krb5-workstation amazon-linux-2023-upgrade-krb5-workstation-debuginfo amazon-linux-2023-upgrade-libkadm5 amazon-linux-2023-upgrade-libkadm5-debuginfo References https://attackerkb.com/topics/cve-2023-39975 CVE - 2023-39975 https://alas.aws.amazon.com/AL2023/ALAS-2023-321.html

FreeBSD: (Multiple Advisories) (CVE-2023-4353): electron{22,24} -- multiple vulnerabilities Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/21/2023 Added 08/18/2023 Modified 01/28/2025 Description Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) freebsd-upgrade-package-chromium freebsd-upgrade-package-electron22 freebsd-upgrade-package-electron24 freebsd-upgrade-package-electron25 freebsd-upgrade-package-ungoogled-chromium References CVE-2023-4353

CVE-2023-36896: Microsoft Excel Remote Code Execution Vulnerability [Office for Mac] Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 11/15/2023 Added 11/10/2023 Modified 01/28/2025 Description CVE-2023-36896: Microsoft Excel Remote Code Execution Vulnerability [Office for Mac] Solution(s) office-for-mac-upgrade-16_76_0 References https://attackerkb.com/topics/cve-2023-36896 CVE - 2023-36896 https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac#august-15-2023

CVE-2023-35371: Microsoft Office Remote Code Execution Vulnerability [Office for Mac] Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 11/15/2023 Added 11/10/2023 Modified 01/28/2025 Description CVE-2023-35371: Microsoft Office Remote Code Execution Vulnerability [Office for Mac] Solution(s) office-for-mac-upgrade-16_76_0 References https://attackerkb.com/topics/cve-2023-35371 CVE - 2023-35371 https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac#august-15-2023

Google Chrome Vulnerability: CVE-2023-4354 Heap buffer overflow in Skia Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/23/2023 Added 08/23/2023 Modified 01/28/2025 Description Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) google-chrome-upgrade-latest References https://attackerkb.com/topics/cve-2023-4354 CVE - 2023-4354 https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html

Google Chrome Vulnerability: CVE-2023-4352 Type Confusion in V8 Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 08/15/2023 Created 08/23/2023 Added 08/23/2023 Modified 01/28/2025 Description Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) google-chrome-upgrade-latest References https://attackerkb.com/topics/cve-2023-4352 CVE - 2023-4352 https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html

Microsoft Edge Chromium: CVE-2023-4363 Inappropriate implementation in WebShare Severity 4 CVSS (AV:N/AC:M/Au:N/C:N/I:P/A:N) Published 08/15/2023 Created 08/22/2023 Added 08/22/2023 Modified 01/28/2025 Description Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium) Solution(s) microsoft-edge-upgrade-latest References https://attackerkb.com/topics/cve-2023-4363 CVE - 2023-4363 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4363