UCSF IT Technology

Security Updates released for vulnerabilities in Curl. The worst of these vulnerabilities would allow a heap buffer overflow in the SOCKS5 proxy handshake.

Lipnitskiy and GitHub Security Lab disclosed a vulnerability in Lipnitskiy libcue that is impacting GNOME. An attacker could exploit this vulnerability to perform arbitrary code execution.  For a complete description of the vulnerabilities and affected systems go to CVE-2023-43641. IT Security

RedTeam discovered a vulnerability in the D-Link DAP-X1860 Wi-Fi 6 range extender. An attacker could exploit this vulnerability to perform a DoS (denial of service) attack and remote command injection. There is no patch.

Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit these vulnerabilities to take control of an affected system.  

Microsoft released their October Security Update to address vulnerabilities in multiple Microsoft products. For a complete description of the vulnerabilities and affected systems go to 

Citrix has released security updates to address vulnerabilities impacting multiple Citrix Products. An attacker could exploit the vulnerability to take control of an affected system.

Microsoft  has released security updates to address a vulnerability in Windows Server 2022 Layer 2 Tunneling Protocol. The vulnerability can be exploited to perform remote code execution.

Researchers and vendors have disclosed a vulnerability in HTTP/2 protocol. The vulnerability can be exploited to allow a denial of service and has been exploited in the wild August through October 2023. For a complete description of the vulnerabilities and affected systems go to CVE-2023-44487. IT Security

Apple has released a security update to address overheating and vulnerabilities in Apple iOS. A device could get overheated and/or a cyber threat actor could exploit the vulnerabilities to take control of an affected device. For a complete description of the vulnerabilities and affected systems go to About the security content of iOS 17.0.3 and iPadOS 17.0.3. IT Security

Atlassian has published a security bulletin to address an actively exploited vulnerability in Atlassian Confluence Server and Data Center. The vulnerability can be exploited to allow privilege escalation.