yaracroft @venom@nanao.cybtex.fr

CVE-2021-35520 ; CVE-2021-35521 ; CVE-2021-35522 - by exploiting these vulnerabilities, attackers can perform Remote Command Execution (RCE), cause a denial of service (DoS), and read and write arbitrary files on the device #vuln #informatique

https://www.ptsecurity.com/ww-en/about/news/idemia-fixed-biometric-identification-devices-vulnerabilities-discovered-by-positive-technologies/

CVE-2021-33909 - We discovered a size_t-to-int conversion vulnerability in the #Linux kernel's filesystem layer: by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, an unprivileged local attacker can write the 10-byte string //deleted to an offset of exactly -2GB-10B below the beginning of a vmalloc()ated kernel buffer. We successfully exploited this uncontrolled out-of-bounds write, and obtained full root privileges on default installations of Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11, and Fedora 34 Workstation; other Linux distributions are certainly vulnerable, and probably exploitable. Our exploit requires approximately 5GB of memory and 1M inodes; we will publish it in the near future. #vuln #informatique

https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt

CVE-2021-3438 - 16 Years In Hiding - Millions of #Printers Worldwide Vulnerable. This led to the discovery of a high severity vulnerability in HP, Xerox, and Samsung printer driver #software that has remained undisclosed for 16 years. Millions of devices and likely millions of users worldwide. This vulnerability affects a very long list of over 380 different #HP and #Samsung printer models as well as at least a dozen different #Xerox products. #vuln #informatique

https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/

Multiples vulnerabilities discovered in #Apple products #vuln #informatique

https://support.apple.com/en-us/HT201222

💥 WARNING 💥 July 14, 2021 STOP and DISABLE the « Print Spooler » service on all #Microsoft Active Directory (AD) Domain Controllers (DC)

CISA has determined that this vulnerability poses an unacceptable risk to Federal Civilian Executive Branch agencies and requires emergency action. This determination is based on the current exploitation of this vulnerability by threat actors in the wild, the likelihood of further exploitation of the vulnerability, the prevalence of the affected #software in the federal enterprise and the high potential for a compromise of agency information systems #vuln #cyber #threats #informatique

https://cyber.dhs.gov/ed/21-04/

#Adobe Bridge : This update addresses critical & moderate vulnerabilities that could lead to arbitrary code execution in the context of the current user #vuln #informatique

#Adobe Acrobat and #Adobe Reader : These updates address multiple critical & important vulnerabilities. Successful exploitation could lead to arbitrary code execution in the context of the current user #vuln #informatique

#Adobe Framemaker : This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user #vuln #informatique

#Adobe Illustrator 2021 : This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution in the context of current user #vuln #informatique

#Adobe Dimension : This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution in the context of current user #vuln #informatique

Multiples vulnerabilities discovered in #SAP products #vuln #informatique

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506

CVE-2021-22928 - A vulnerability has been identified in #Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has either Citrix Profile Management or Citrix Profile Management WMI Plugin installed to escalate their privilege level on that Windows VDA to SYSTEM #vuln #informatique

https://support.citrix.com/article/CTX319750

Multiples vulnerabilities discovered in Microsoft products #vuln #informatique

https://msrc.microsoft.com/update-guide/releaseNote/2021-Jul

Multiple vulnerabilities in VMware ESXi products #vuln #informatique

https://www.vmware.com/security/advisories/VMSA-2021-0014.html