Overview
Oracle have released a critical patch update, addressing multiple vulnerabilities found in their products. This update comprises of 389 new security patches, and Oracle have advised customers to review their advisory if you use any of their products.
Citrix have released a security bulletin for vulnerabilities affecting both NetScaler ADC and NetScaler Gateway. CVE-2023-6548 allows for authenticated remote code execution on Management interfaces, which CV-E-2023-6549 allows for denial of service.
Atlassian have released their January security update, addressing multiple vulnerabilities found in multiple products. The main vulnerability is CVE-2023-22527, which affects out-of-date versions of Confluence Data Center allowing for remote code execution.
Ivanti are still being actively exploited through vulnerabilities in Connect Secure and Policy Secure Solutions. Malicious actors can move through the systems laterally, perform data exfiltration and establish persistent system access. Ivanti are actively working to prepare security patches for affected products, but have advised users to remain vigilant. We will continue to update you as we find out more.
VMware have released an advisory addressing vulnerabilities found in vCenter Server. CVE-2023-34048, categorised as critical with a base score of 9.8, causes out-of-bound write requests while CVE-2023-34056, categorised as medium with a base score of 4.3, allows for partial information disclosure.
Apple have released a security update addressing multiple vulnerabilities, affecting the following products:
- iOS 17.3 and iPadOS 17.3
- iOS 16.7.5 and iPadOS 16.7.5
- iOS 15.8.1 and iPadOS 15.8.1
- macOS Sonoma 14.3
- macOS Ventura 13.6.4
- macOS Monterey 12.7.3
- Safari 17.3
- watchOS 10.3
- tvOS 17.3
Fortra have released an advisory addressing a critical vulnerability found in GoAnywhere MT. CVE-2024-0204 is classed as critical, with a base score of 9.8 allows unauthorised users to create an admin user via administration portals.
Mozilla have released security advisories addressing vulnerabilities in Thunderbird and Firefox. The main vulnerabilities are summarised below:
- CVE-2024-0741: An out-of-bounds write exception in Thunderbird ANGLE which could allow attackers to corrupt memory, leading to an exploitable crash.
- CVE-2024-0742: Allows certain browser prompts and dialogues to be activated or dismissed unintentionally by the use due to incorrect timestamps, affecting Firefox ESR 115.7.
- CVE-2024-0743: An uncheckable return value in the TLS handshake code can cause exploitable crashes, affecting Firefox 122.
Orthanc have released a security bulletin addressing a high vulnerability affecting Osimis DICOM Web Viewer. CVE-2023-7238 is a cross-site scripting vulnerability, which allows attackers to execute arbitrary code in the targeted user’s browser.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Oracle – Security Patch Advisory
Citrix – Security Bulletin
Atlassian – Security Bulletin and CVE-2023-22527
Ivanti – Exploitation Mitigations - 24/01/2024
VMware – Advisory Notice
Fortra – Advisory Notice
Apple – Security Update
Mozilla – Thunderbird 115.7, Firefox ESR 115.7 and Firefox 122
Orthanc – Security Bulletin