To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Google have issued a security vulnerability notice about Chrome. Attackers can use the vulnerabilities to cause memory overflow of the target system, then leak information or execute arbitrary code remotely. Please be reminded to update the system as soon as possible if you are using the affected products. 

Related vulnerabilities

1. CVE-2023-1810

Heap buffer overflow vulnerability in Visuals component.

2. CVE-2023-1811

Use-after-free vulnerability in Frames component.

3. CVE-2023-1812

Out-of-bounds memory access vulnerability in DOM Bindings component.

4. CVE-2023-1813

Improper settings issue in Extensions component.

5. CVE-2023-1814

Insufficient validation of user input in Safe Browsing component.

6. CVE-2023-1815

Use-after-free vulnerability in Networking APIs component.

7. CVE-2023-1816

Insecure UI settings in Picture In Picture component.

8. CVE-2023-1817

Security rule settings problem in Intents component.

9. CVE-2023-1818

Use-after-free vulnerability in Vulkan components.

10. CVE-2023-1819

Out-of-bounds read vulnerability in Accessibility component.

11. CVE-2023-1820

Heap buffer overflow vulnerability in Browser History component.

12. CVE-2023-1821

Improper settings issue in WebShare component.

13. CVE-2023-1822

Insecure UI settings in Navigation component.

14. CVE-2023-1823

Improper settings issue in FedCM component.

15. Other unlisted vulnerabilities

Affected Products

Google Chrome version lower than 112.0.5615.49

For more details, please refer to: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop.html

Mitigation

If the above-mentioned affected products are being used, please update the Google Chrome as soon as possible.

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office

To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Apple have recently issued several security vulnerability update notices, among which Apple Webkit Arbitrary Code Execution Vulnerability (CVE-2023-23529) is a zero-day vulnerability. There are signs that the related vulnerabilities have been exploited recently. Please arrange backup and install updates as soon as possible if you are using the above affected products.

Related vulnerabilities

Apple Webkit Arbitrary Code Execution Vulnerability (CVE-2023-23529)

Due to the type confusion error in Apple Webkit, this vulnerability allows an unauthenticated remote attacker to trick the victim to visit its specially crafted malicious website, which causes Webkit to trigger a type confusion error when processing the web content, and finally execute arbitrary code on the target system. In addition, attackers can combine CVE-2023-23529 and CVE-2023-23514 to escalate privileges and escape the Safari sandbox.

Affected Products

• Apple iOS < 16.3.1, iPadOS < 16.3.1, Apple macOS Ventura < 13.2.1
• Apple watchOS < 9.3.1, Apple tvOS < 16.3.2, Apple Safari < 16.3.1

For more details, please refer to:

• https://support.apple.com/en-us/HT213633 
• https://support.apple.com/en-us/HT213635

Mitigation

If the above-mentioned affected products are being used, please

• arrange testing and install security updates released by Apple as soon as possible;
• pay attention to backup work before updating.

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office