Skip to main content

The update addresses 225 vulnerabilities in Juniper Secure Analytics, including five rated critical

Threat ID:CC-4514
Threat Severity:Medium
Published:24 June 2024 1:39 PM

Summary

The update addresses 225 vulnerabilities in Juniper Secure Analytics, including five rated critical

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 7.5.0 UP8 IF03
Juniper Secure Analytics

Threat details

Introduction

Juniper Networks has released a security update addressing 225 vulnerabilities in multiple software libraries used by Juniper Secure Analytics, including five critical vulnerabilities with a CVSSv3 score of 9.8. Juniper Secure Analytics is a security information and event management (SIEM) and log analytics system for the Juniper Connected Security portfolio of products.

Remediation advice

Affected organisations are encouraged to review the Juniper Networks security bulletin JSA82681 and apply update 7.5.0 UP8 IF03.

Definitive source of threat updates

CVE Vulnerabilities

StatusPublished
CVE-2019-13224A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
StatusPublished
CVE-2019-19012An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
StatusPublished
CVE-2019-15505drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may be remote via usbip or usbredir).
StatusPublished
CVE-2023-5178A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation.
StatusPublished
CVE-2023-25775Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

Last edited: 24 June 2024 1:39 pm

Back to top