Google’s Pixel units have already acquired the November replace, together with some extra fixes. The November Android Safety Bulletin has additionally began to roll out to a few of Samsung’s Galaxy line.
Microsoft
Microsoft has a Patch Tuesday each month, however November’s is value discover. The replace fixes 59 vulnerabilities, two of that are already being exploited in real-life assaults. Tracked as CVE-2023-36033, the primary is an elevation of privilege vulnerability in Home windows DWM Core Library marked as necessary, with a CVSS rating of seven.8. “An attacker who efficiently exploited this vulnerability may acquire SYSTEM privileges,” Microsoft stated.
In the meantime, CVE-2023-36036 is an elevation of privilege vulnerability in Home windows Cloud Recordsdata Mini Filter Driver with a CVSS rating of seven.8. Additionally fastened in November’s replace cycle is the already exploited libWep flaw beforehand fixed in Chrome and different browsers, which additionally impacts Microsoft’s Edge, tracked as CVE-2023-4863.
One other notable flaw is CVE-2023-36397, a distant code execution vulnerability in Home windows Pragmatic Common Multicast marked as vital with a CVSS rating of 9.8. “When Home windows message queuing service is operating in a PGM Server setting, an attacker may ship a specifically crafted file over the community to realize distant code execution and try and set off malicious code,” Microsoft stated.
Cisco
Enterprise software program agency Cisco has issued fixes for 27 safety flaws, together with one rated as vital with a close to most CVSS rating of 9.9. Tracked as CVE-2023-20048, the vulnerability within the net providers interface of Cisco Firepower Administration Middle Software program may permit an authenticated, distant attacker to execute unauthorized configuration instructions on a Firepower Menace Protection gadget managed by the FMC Software program.
Nonetheless, to efficiently exploit the vulnerability, an attacker would want legitimate credentials on the FMC Software program, Cisco said.
An additional seven of the issues fastened by Cisco are rated as having a excessive influence, together with CVE-2023-20086—a denial-of-service flaw with a CVSS rating of 8.6—and CVE-2023-20063, a code-injection vulnerability with a CVSS rating of 8.2.
Atlassian
Atlassian has released a patch to repair a critical flaw already being utilized in real-life assaults. Tracked as CVE-2023-22518, the improper-authorization vulnerability problem in Confluence Information Middle and Server is being utilized in ransomware assaults. “As a part of Atlassian’s ongoing monitoring and investigation of this CVE, we noticed a number of energetic exploits and stories of risk actors utilizing ransomware,” it stated.
Safety outfit Development Micro reported the Cerber ransomware group is utilizing the flaw in assaults. “This isn’t the primary time that Cerber has focused Atlassian—in 2021, the malware re-emerged after a interval of inactivity and centered on exploiting distant code execution vulnerabilities in Atlassian’s GitLab servers,” Development Micro stated.
All variations of Confluence Information Middle and Server are affected by the flaw, which permits an unauthenticated attacker to reset Confluence and create an administrator account. “Utilizing this account, an attacker can carry out all administrative actions out there to a Confluence occasion administrator, resulting in a full lack of confidentiality, integrity and availability,” Atlassian stated.
SAP
Enterprise software program big SAP has launched its November Security Patch Day, fixing three new flaws. Tracked as CVE-2023-31403 and with a CVSS rating of 9.6, probably the most critical problem is an improper entry management vulnerability flaw in SAP Enterprise One. Because of exploiting the problem, a malicious person may learn and write to the SMB shared folder, the software program big stated.
