Skip to main content

Two critical vulnerabilities could lead to remote code execution

Threat ID:CC-45144515
Threat Severity:Medium
Published:2425 June 2024 1:3948 PM

Summary

TheTwo update addresses 225critical vulnerabilities incould Juniperlead Secureto Analytics,remote includingcode five rated criticalexecution

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 7.5.11.1.3.0 UP8 IF03
JuniperAvaya SecureIP AnalyticsOffice

Threat details

Introduction

Juniper NetworksAvaya has released aan securityadvisory updateto addressingaddress 225two vulnerabilities in multipleIP software libraries used by Juniper Secure Analytics, including five critical vulnerabilities withOffice, a unified communications platform that allows for call recording, tracking, and reporting.

Remediation advice

Affected organisations are encouraged to review theAvaya JuniperIP NetworksOffice Vulnerability advisory security bulletin JSA82681ASA-2024-001 and apply updatethe 7.5.0relevant UP8security IF03.update. 

Definitive source of threat updates

CVE Vulnerabilities

StatusPublished
CVE-2019-13224A2024-4196An use-after-freeimproper input validation vulnerability was discovered in onig_new_deluxe()Avaya inIP regext.cOffice inthat Onigurumacould 6.9.2allow allowsremote attackers to potentially cause information disclosure, denial of service,command or possibly code execution by providingvia a specially crafted regularweb expression.request Theto attackerthe providesWeb aControl paircomponent. ofAffected aversions regexinclude patternall andversions aprior string,to with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.11.1.3.1.
StatusPublished
CVE-2019-19012An2024-4197An integerunrestricted overflowfile upload vulnerability in theAvaya search_in_rangeIP functionOffice inwas regexec.cdiscovered inthat Onigurumacould 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression.
StatusPublished
CVE-2019-15505drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB device traffic (which may beallow remote via usbipcommand or usbredir).
StatusPublished
CVE-2023-5178A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which may permit remote code execution orvia leadthe One-X component. Affected versions include all versions prior to local privilege escalation.
StatusPublished
CVE-2023-25775Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 11.1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access.3.1.

Last edited: 2425 June 2024 1:3948 pm

Back to top