Google’s Pixel gadgets have already acquired the November replace, together with some further fixes. The November Android Safety Bulletin has additionally began to roll out to a few of Samsung’s Galaxy line.
Microsoft
Microsoft has a Patch Tuesday each month, however November’s is value discover. The replace fixes 59 vulnerabilities, two of that are already being exploited in real-life assaults. Tracked as CVE-2023-36033, the primary is an elevation of privilege vulnerability in Home windows DWM Core Library marked as vital, with a CVSS rating of seven.8. “An attacker who efficiently exploited this vulnerability might achieve SYSTEM privileges,” Microsoft stated.
In the meantime, CVE-2023-36036 is an elevation of privilege vulnerability in Home windows Cloud Recordsdata Mini Filter Driver with a CVSS rating of seven.8. Additionally fastened in November’s replace cycle is the already exploited libWep flaw beforehand fastened in Chrome and different browsers, which additionally impacts Microsoft’s Edge, tracked as CVE-2023-4863.
One other notable flaw is CVE-2023-36397, a distant code execution vulnerability in Home windows Pragmatic Basic Multicast marked as crucial with a CVSS rating of 9.8. “When Home windows message queuing service is working in a PGM Server atmosphere, an attacker might ship a specifically crafted file over the community to attain distant code execution and try to set off malicious code,” Microsoft stated.
Cisco
Enterprise software program agency Cisco has issued fixes for 27 safety flaws, together with one rated as crucial with a close to most CVSS rating of 9.9. Tracked as CVE-2023-20048, the vulnerability within the net providers interface of Cisco Firepower Administration Heart Software program might permit an authenticated, distant attacker to execute unauthorized configuration instructions on a Firepower Risk Protection machine managed by the FMC Software program.
Nevertheless, to efficiently exploit the vulnerability, an attacker would wish legitimate credentials on the FMC Software program, Cisco stated.
An additional seven of the failings fastened by Cisco are rated as having a excessive influence, together with CVE-2023-20086—a denial-of-service flaw with a CVSS rating of 8.6—and CVE-2023-20063, a code-injection vulnerability with a CVSS rating of 8.2.
Atlassian
Atlassian has launched a patch to repair a severe flaw already being utilized in real-life assaults. Tracked as CVE-2023-22518, the improper-authorization vulnerability subject in Confluence Information Heart and Server is being utilized in ransomware assaults. “As a part of Atlassian’s ongoing monitoring and investigation of this CVE, we noticed a number of energetic exploits and experiences of menace actors utilizing ransomware,” it stated.
Safety outfit Pattern Micro reported the Cerber ransomware group is utilizing the flaw in assaults. “This isn’t the primary time that Cerber has focused Atlassian—in 2021, the malware re-emerged after a interval of inactivity and targeted on exploiting distant code execution vulnerabilities in Atlassian’s GitLab servers,” Pattern Micro stated.
All variations of Confluence Information Heart and Server are affected by the flaw, which permits an unauthenticated attacker to reset Confluence and create an administrator account. “Utilizing this account, an attacker can carry out all administrative actions obtainable to a Confluence occasion administrator, resulting in a full lack of confidentiality, integrity and availability,” Atlassian stated.
SAP
Enterprise software program large SAP has launched its November Safety Patch Day, fixing three new flaws. Tracked as CVE-2023-31403 and with a CVSS rating of 9.6, essentially the most severe subject is an improper entry management vulnerability flaw in SAP Enterprise One. On account of exploiting the difficulty, a malicious consumer might learn and write to the SMB shared folder, the software program large stated.