ISHACK AI BOT

Juniper Junos OS: 2023-01 Security Bulletin: Junos OS: MX Series: FPC crash when an IPsec6 tunnel processes specific IPv4 packets (JSA70209) (CVE-2023-22413) Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:P) Published 01/13/2023 Created 03/23/2023 Added 03/22/2023 Modified 12/06/2023 Description An Improper Check or Handling of Exceptional Conditions vulnerability in the IPsec library of Juniper Networks Junos OS allows a network-based, unauthenticated attacker to cause Denial of Service (DoS). On all MX platforms with MS-MPC or MS-MIC card, when specific IPv4 packets are processed by an IPsec6 tunnel, the Multiservices PIC Management Daemon (mspmand) process will core and restart. This will lead to FPC crash. Traffic flow is impacted while mspmand restarts. Continued receipt of these specific packets will cause a sustained Denial of Service (DoS) condition. This issue only occurs if an IPv4 address is not configured on the multiservice interface. This issue affects: Juniper Networks Junos OS on MX Series All versions prior to 19.4R3-S9; 20.1 version 20.1R3-S5 and later versions; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R2. Solution(s) juniper-junos-os-upgrade-latest References https://attackerkb.com/topics/cve-2023-22413 CVE - 2023-22413 JSA70209

OS X update for dcerpc (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

Oracle Linux: CVE-2023-0266: ELSA-2023-1566:kernel security, bug fix, and enhancement update (IMPORTANT) (Multiple Advisories) Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 01/13/2023 Created 03/22/2023 Added 03/17/2023 Modified 02/14/2025 Description A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e A use-after-free flaw was found in snd_ctl_elem_read in sound/core/control.c in Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak problem. Solution(s) oracle-linux-upgrade-kernel oracle-linux-upgrade-kernel-uek References https://attackerkb.com/topics/cve-2023-0266 CVE - 2023-0266 ELSA-2023-1566 ELSA-2023-12196 ELSA-2023-1470

Huawei EulerOS: CVE-2023-0288: vim security update Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 03/10/2023 Added 03/09/2023 Modified 01/28/2025 Description Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Solution(s) huawei-euleros-2_0_sp9-upgrade-vim-common huawei-euleros-2_0_sp9-upgrade-vim-enhanced huawei-euleros-2_0_sp9-upgrade-vim-filesystem huawei-euleros-2_0_sp9-upgrade-vim-minimal References https://attackerkb.com/topics/cve-2023-0288 CVE - 2023-0288 EulerOS-SA-2023-1485

OS X update for Shortcuts (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

Alpine Linux: CVE-2023-0288: Vulnerability in Multiple Components Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 03/22/2024 Added 03/26/2024 Modified 10/02/2024 Description Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Solution(s) alpine-linux-upgrade-vim References https://attackerkb.com/topics/cve-2023-0288 CVE - 2023-0288 https://security.alpinelinux.org/vuln/CVE-2023-0288

OS X update for Foundation (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for LaunchServices (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

Huawei EulerOS: CVE-2023-0288: vim security update Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 03/22/2023 Added 03/20/2023 Modified 01/28/2025 Description Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Solution(s) huawei-euleros-2_0_sp10-upgrade-vim-common huawei-euleros-2_0_sp10-upgrade-vim-enhanced huawei-euleros-2_0_sp10-upgrade-vim-filesystem huawei-euleros-2_0_sp10-upgrade-vim-minimal References https://attackerkb.com/topics/cve-2023-0288 CVE - 2023-0288 EulerOS-SA-2023-1568

OS X update for Safari (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for AMD (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

SUSE: CVE-2023-0288: SUSE Linux Security Advisory Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 01/31/2023 Added 01/31/2023 Modified 01/28/2025 Description Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Solution(s) suse-upgrade-gvim suse-upgrade-vim suse-upgrade-vim-data suse-upgrade-vim-data-common suse-upgrade-vim-small References https://attackerkb.com/topics/cve-2023-0288 CVE - 2023-0288

OS X update for CoreCapture (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for ImageIO (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for curl (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

SUSE: CVE-2022-48258: SUSE Linux Security Advisory Severity 5 CVSS (AV:N/AC:L/Au:N/C:P/I:N/A:N) Published 01/13/2023 Created 02/14/2023 Added 02/13/2023 Modified 01/28/2025 Description In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles. Solution(s) suse-upgrade-eternalterminal References https://attackerkb.com/topics/cve-2022-48258 CVE - 2022-48258

Amazon Linux AMI 2: CVE-2022-41721: Security patch for containerd (Multiple Advisories) Severity 8 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:C) Published 01/13/2023 Created 01/24/2024 Added 01/23/2024 Modified 01/28/2025 Description A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. Solution(s) amazon-linux-ami-2-upgrade-containerd amazon-linux-ami-2-upgrade-containerd-debuginfo amazon-linux-ami-2-upgrade-containerd-stress References https://attackerkb.com/topics/cve-2022-41721 AL2/ALASDOCKER-2024-035 AL2/ALASNITRO-ENCLAVES-2024-035 CVE - 2022-41721

OS X update for NetworkExtension (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for Messages (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for Model I/O (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for AppleScript (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

Amazon Linux 2023: CVE-2023-0179: Important priority package update for kernel Severity 7 CVSS (AV:L/AC:L/Au:S/C:C/I:C/A:C) Published 01/13/2023 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. Solution(s) amazon-linux-2023-upgrade-bpftool amazon-linux-2023-upgrade-bpftool-debuginfo amazon-linux-2023-upgrade-kernel amazon-linux-2023-upgrade-kernel-debuginfo amazon-linux-2023-upgrade-kernel-debuginfo-common-aarch64 amazon-linux-2023-upgrade-kernel-debuginfo-common-x86-64 amazon-linux-2023-upgrade-kernel-devel amazon-linux-2023-upgrade-kernel-headers amazon-linux-2023-upgrade-kernel-libbpf amazon-linux-2023-upgrade-kernel-libbpf-devel amazon-linux-2023-upgrade-kernel-libbpf-static amazon-linux-2023-upgrade-kernel-livepatch-6-1-10-15-42 amazon-linux-2023-upgrade-kernel-tools amazon-linux-2023-upgrade-kernel-tools-debuginfo amazon-linux-2023-upgrade-kernel-tools-devel amazon-linux-2023-upgrade-perf amazon-linux-2023-upgrade-perf-debuginfo amazon-linux-2023-upgrade-python3-perf amazon-linux-2023-upgrade-python3-perf-debuginfo References https://attackerkb.com/topics/cve-2023-0179 CVE - 2023-0179 https://alas.aws.amazon.com/AL2023/ALAS-2023-070.html

OS X update for Calendar (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for Camera (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)

OS X update for Carbon Core (CVE-2023-0288) Severity 7 CVSS (AV:L/AC:M/Au:N/C:C/I:C/A:C) Published 01/13/2023 Created 10/14/2024 Added 10/14/2024 Modified 01/28/2025 Description Deprecated Solution(s)