Apple Fixes Two Exploited Vulnerabilities on Intel-based Mac Systems

• CVE-2024-44308 - The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

• CVE-2024-44309 - A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, macOS Sequoia 15.1.1, iOS 18.1.1 and iPadOS 18.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Vulnerabilities discovered by Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group

---

Related vulnerabilities: CVE-2024-44308CVE-2024-44309

Based on Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 , This is a pair of bugs, described as ‘Authentication Bypass in the Management Web Interface’ and a ‘Privilege Escalation‘ respectively, strongly suggesting they are used as a chain to gain superuser access, a pattern that we’ve seen before with Palo Alto appliances. Before we’ve even dived into to code, we’ve already ascertained that we’re looking for a chain of vulnerabilities to achieve that coveted pre-authenticated Remote Code Execution..

The following CVEs were assigned:

• CVE-2024-9474 - A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

• CVE-2024-0012 - An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

---

Related vulnerabilities: CVE-2024-0012CVE-2024-9474

FG-IR-24-115 Arbitrary file read in administrative interface CVE-2024-32117

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22]...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiAnalyzer-BigData 7.4.0, 7.2.7, 7.2.6, 7.2.5, 7.2.4 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

GUI

GUI

Medium Severity

FG-IR-24-032 FortiOS - Improper authentication in fgfmd CVE-2024-26011

An improper authentication vulnerability [CWE-287] in FortiManager, FortiOS, FortiPAM, FortiPortal,...

FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.4, 7.2.3 ... FortiOS 7.4.3, 7.4.2, 7.4.1, 7.4.0, 7.2.7 ... FortiPAM 1.2.0, 1.1.2, 1.1.1, 1.1.0, 1.0.3 ... FortiPortal 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10 ... FortiProxy 7.4.2, 7.4.1, 7.4.0, 7.2.9, 7.2.8 ... FortiSwitchManager 7.2.3, 7.2.2, 7.2.1, 7.2.0, 7.0.3 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

Medium Severity

FG-IR-23-475 FortiOS - SSLVPN session hijacking using SAML authentication CVE-2023-50176

A session fixation vulnerability [CWE-384] in FortiOS may allow an unauthenticated attacker to hijack user...

FortiOS 7.4.3, 7.4.2, 7.4.1, 7.4.0, 7.2.7 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

SSL-VPN

SSL-VPN

High Severity

FG-IR-24-125 Heap buffer overflow in httpd CVE-2024-33505

A heap-based buffer overflow vulnerability [CWE-122] in FortiManager and FortiAnalyzer httpd daemon may...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiAnalyzer Cloud 7.4.2, 7.4.1, 7.2.6, 7.2.5, 7.2.4 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiManager Cloud 7.4.2, 7.4.1, 7.2.6, 7.2.5, 7.2.4 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

GUI

GUI

Medium Severity

FG-IR-23-267 Lack of capacity to filter logs by administrator access CVE-2023-44255

An Exposure of personal information to an unauthorized actor [CWE-359] in FortiManager, FortiAnalyzer &...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.8, 7.2.7 ... FortiAnalyzer-BigData 7.4.0, 7.2.8, 7.2.7, 7.2.6, 7.2.5 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.8, 7.2.7 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

GUI

GUI

Low Severity

FG-IR-24-116 OS command injection in CLI command CVE-2024-32118

An improper neutralization of special elements used in an OS command ('OS Command Injection')...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiAnalyzer-BigData 7.4.0, 7.2.7, 7.2.6, 7.2.5, 7.2.4 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

CLI

CLI

Medium Severity

FG-IR-24-099 Path traversal vulnerability in CLI commands CVE-2024-32116

Multiple relative path traversal vulnerabilities [CWE-23] in FortiManager, FortiAnalyzer &...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiAnalyzer-BigData 7.4.0, 7.2.7, 7.2.6, 7.2.5, 7.2.4 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

CLI

CLI

Medium Severity

FG-IR-24-179 Path traversal vulnerability leading to file creation CVE-2024-35274

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22]...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.8, 7.2.7 ... FortiAnalyzer-BigData 7.4.0, 7.2.8, 7.2.7, 7.2.6, 7.2.5 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.8, 7.2.7 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

CLI

CLI

Low Severity

FG-IR-23-396 Readonly users could run some sensitive operations CVE-2024-23666

A client-side enforcement of server-side security vulnerability [CWE-602] in FortiAnalyzer may allow an...

FortiAnalyzer 7.4.1, 7.4.0, 7.2.4, 7.2.3, 7.2.2 ... FortiAnalyzer-BigData 7.4.0, 7.2.6, 7.2.5, 7.2.4, 7.2.3 ... FortiManager 7.4.1, 7.4.0, 7.2.4, 7.2.3, 7.2.2 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

High Severity

FG-IR-24-033 SSLVPN WEB UI Text injection CVE-2024-33510

An improper neutralization of special elements in output used by a downstream component ('Injection')...

FortiOS 7.4.3, 7.4.2, 7.4.1, 7.4.0, 7.2.8 ... FortiProxy 7.4.3, 7.4.2, 7.4.1, 7.4.0, 7.2.9 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

GUI

GUI

Low Severity

FG-IR-24-098 Stack buffer overflow in CLI command CVE-2024-31496

A stack-based buffer overflow vulnerability [CWE-121] in FortiManager, FortiAnalyzer and...

FortiAnalyzer 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ... FortiAnalyzer-BigData 7.4.0, 7.2.7, 7.2.6, 7.2.5, 7.2.4 ... FortiManager 7.4.2, 7.4.1, 7.4.0, 7.2.5, 7.2.4 ...

Published: Nov 12, 2024

Published: Nov 12, 2024

---

Related vulnerabilities: CVE-2024-35274CVE-2024-23666CVE-2024-33510CVE-2024-32118CVE-2024-33505CVE-2024-32117CVE-2024-32116CVE-2024-31496CVE-2023-44255CVE-2024-26011CVE-2023-50176

Ivanti has released updates for Ivanti Endpoint Manager which addresses high and critical severity vulnerabilities.

Ivanti is not aware of any customers being exploited by these vulnerabilities at the time of disclosure.

Security Advisory EPM November 2024 for EPM 2024 and EPM 2022 SU6

Primary Product

Endpoint Manager

Created Date

12 Nov 2024 15:00:14

Last Modified Date

12 Nov 2024 21:33:24

Summary 

Ivanti has released updates for Ivanti Endpoint Manager which addresses high and critical severity vulnerabilities.  

We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. 

Vulnerability Details: 

CVE Number 

Description 

CVSS Score (Severity) 

CVSS Vector 

CWE 

CVE-2024-34787 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.  

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50322 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. 

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-32839 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32841 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.  

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32844 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32847 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34780 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-37376 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34781 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34782 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34784 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50323 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. 

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50324 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50326 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50327 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50328 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50329 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. 

8.8 (High) 

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50330 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. 

9.8 (Critical) 

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

Affected Versions 

Product Name 

Affected Version(s) 

Resolved Version(s) 

Patch Availability 

Ivanti Endpoint Manager (EPM) 

2024 September security update and prior, 
2022 SU6 September security update and prior 

2024 November Security Update, 2022 SU6 November Security Update 

---

Related vulnerabilities: CVE-2024-50323CVE-2024-34787CVE-2024-32844CVE-2024-50324CVE-2024-34780CVE-2024-50326CVE-2024-50328CVE-2024-32847CVE-2024-50329CVE-2024-50330CVE-2024-34781CVE-2024-34784CVE-2024-34782CVE-2024-32839CVE-2024-50327CVE-2024-32841CVE-2024-50322CVE-2024-37376

• Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability - Patch ASAP! - June 2024 - CVE-2024-5806 and CVE-2024-5805
• Third Flaw Uncovered in MOVEit Transfer App Amidst Cl0p Ransomware Mass Attack - Jun 16, 2023 - CVE-2023-35708
• Amazon confirms employee data breach after vendor hack - November 11, 2024 - Most probably CVE-2023-35708

---

Related vulnerabilities: CVE-2024-5805CVE-2024-5806CVE-2023-35708

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2024-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version.

Android partners are notified of all issues at least a month before publication. Source code patches for these issues have been released to the Android Open Source Project (AOSP) repository and linked from this bulletin. This bulletin also includes links to patches outside of AOSP.

The most severe of these issues is a high security vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.

Refer to the Android and Google Play Protect mitigations section for details on the Android security platform protections and Google Play Protect, which improve the security of the Android platform. Android and Google service mitigations

This is a summary of the mitigations provided by the Android security platform and service protections such as Google Play Protect. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.

Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
The Android security team actively monitors for abuse through Google Play Protect and warns users about Potentially Harmful Applications. Google Play Protect is enabled by default on devices with Google Mobile Services, and is especially important for users who install apps from outside of Google Play.

Note: There are indications that the following may be under limited, targeted exploitation.

CVE-2024-43047
CVE-2024-43093

2024-11-01 security patch level vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2024-11-01 patch level. Vulnerabilities are grouped under the component they affect. Issues are described in the tables below and include CVE ID, associated references, type of vulnerability, severity, and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID. Devices with Android 10 and later may receive security updates as well as Google Play system updates. Framework

The most severe vulnerability in this section could lead to local escalation of privilege with no additional execution privileges needed. CVE References Type Severity Updated AOSP versions CVE-2024-40660 A-347307756 [2] EoP High 14, 15 CVE-2024-43081 A-341256043 EoP High 12, 12L, 13, 14, 15 CVE-2024-43085 A-353712853 EoP High 12, 12L, 13, 14, 15 CVE-2024-43093 A-341680936 EoP High 12, 13, 14, 15 CVE-2024-43082 A-296915959 ID High 12, 12L CVE-2024-43084 A-281044385 ID High 12, 12L, 13, 14, 15 CVE-2024-43086 A-343440463 ID High 12, 12L, 13, 14, 15 System

The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed. CVE References Type Severity Updated AOSP versions CVE-2024-43091 A-344620577 RCE High 12, 12L, 13, 14, 15 CVE-2024-29779 A-329701910 EoP High 14 CVE-2024-34719 A-242996380 EoP High 12, 12L, 13, 14 CVE-2024-40661 A-308138085 EoP High 12, 12L, 13, 14 CVE-2024-43080 A-330722900 EoP High 12, 12L, 13, 14, 15 CVE-2024-43087 A-353700779 EoP High 12, 12L, 13, 14, 15 CVE-2024-43088 A-326057017 EoP High 12, 12L, 13, 14, 15 CVE-2024-43089 A-304280682 EoP High 12, 12L, 13, 14, 15 CVE-2024-43090 A-331180422 ID High 12, 12L, 13, 14 CVE-2024-43083 A-348352288 DoS High 12, 12L, 13, 14, 15 Google Play system updates

The following issues are included in Project Mainline components. Subcomponent CVE Documents UI CVE-2024-43093 MediaProvider CVE-2024-43089 Permission Controller CVE-2024-40661 WiFi CVE-2024-43083 2024-11-05 security patch level vulnerability details

In the sections below, we provide details for each of the security vulnerabilities that apply to the 2024-11-05 patch level. Vulnerabilities are grouped under the component they affect. Issues are described in the tables below and include CVE ID, associated references, type of vulnerability, severity, and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID. Kernel

The most severe vulnerability in this section could lead to local escalation of privilege with no additional execution privileges needed. CVE References Type Severity Subcomponent CVE-2024-36978 A-349777785 Upstream kernel [2] EoP High Net CVE-2024-46740 A-352520660 Upstream kernel [2] [3] [4] [5] [6] [7] [8] EoP High Binder Kernel LTS

The following kernel versions have been updated. Kernel version updates are dependent on the version of Android OS at the time of device launch. References Android Launch Version Kernel Launch Version Minimum Update Version A-348473863 12 5.4 5.4.274 A-348681334 12 4.19 4.19.312 Imagination Technologies

These vulnerabilities affect Imagination Technologies components and further details are available directly from Imagination Technologies. The severity assessment of these issues is provided directly by Imagination Technologies. CVE References Severity Subcomponent CVE-2024-34747 A-346643520 * High PowerVR-GPU CVE-2024-40671 A-355477536 * High PowerVR-GPU Imagination Technologies

These vulnerabilities affect Imagination Technologies components and further details are available directly from Imagination Technologies. The severity assessment of these issues is provided directly by Imagination Technologies. CVE References Severity Subcomponent CVE-2023-35659 A-350006107 * High PowerVR-GPU CVE-2023-35686 A-350527097 * High PowerVR-GPU CVE-2024-23715 A-350530745 * High PowerVR-GPU CVE-2024-31337 A-337944529 * High PowerVR-GPU CVE-2024-34729 A-331437862 * High PowerVR-GPU MediaTek components

These vulnerabilities affect MediaTek components and further details are available directly from MediaTek. The severity assessment of these issues is provided directly by MediaTek. CVE References Severity Subcomponent CVE-2024-20104 A-363850556 M-ALPS09073261 * High DA CVE-2024-20106 A-363849996 M-ALPS08960505 * High m4u Qualcomm components

These vulnerabilities affect Qualcomm components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm. CVE References Severity Subcomponent CVE-2024-21455 A-357616450 QC-CR#3839449 [2] QC-CR#3875202 [2] High Kernel CVE-2024-38402 A-364017423 QC-CR#3890158 High Kernel CVE-2024-38405 A-357615761 QC-CR#3754687 High WLAN CVE-2024-38415 A-357616194 QC-CR#3775520 [2] High Camera CVE-2024-38421 A-357616018 QC-CR#3793941 High Display CVE-2024-38422 A-357616000 QC-CR#3794268 [2] [3] High Audio CVE-2024-38423 A-357615775 QC-CR#3799033 High Display CVE-2024-43047 A-364017103 QC-CR#3883647 High Kernel Qualcomm closed-source components

These vulnerabilities affect Qualcomm closed-source components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm. CVE References Severity Subcomponent CVE-2024-38408 A-357615875 * Critical Closed-source component CVE-2024-23385 A-339043003 * High Closed-source component CVE-2024-38403 A-357615948 * High Closed-source component CVE-2024-38424 A-357616230 * High Closed-source component Common questions and answers

This section answers common questions that may occur after reading this bulletin.

1. How do I determine if my device is updated to address these issues?

To learn how to check a device's security patch level, see Check and update your Android version.

Security patch levels of 2024-11-01 or later address all issues associated with the 2024-11-01 security patch level.
Security patch levels of 2024-11-05 or later address all issues associated with the 2024-11-05 security patch level and all previous patch levels.

Device manufacturers that include these updates should set the patch string level to:

[ro.build.version.security_patch]:[2024-11-01]
[ro.build.version.security_patch]:[2024-11-05]

For some devices on Android 10 or later, the Google Play system update will have a date string that matches the 2024-11-01 security patch level. Please see this article for more details on how to install security updates.

1. Why does this bulletin have two security patch levels?

This bulletin has two security patch levels so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level.

Devices that use the 2024-11-01 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.
Devices that use the security patch level of 2024-11-05 or newer must include all applicable patches in this (and previous) security bulletins.

Partners are encouraged to bundle the fixes for all issues they are addressing in a single update.

1. What do the entries in the Type column mean?

Entries in the Type column of the vulnerability details table reference the classification of the security vulnerability. Abbreviation Definition RCE Remote code execution EoP Elevation of privilege ID Information disclosure DoS Denial of service N/A Classification not available

1. What do the entries in the References column mean?

Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. Prefix Reference A- Android bug ID QC- Qualcomm reference number M- MediaTek reference number N- NVIDIA reference number B- Broadcom reference number U- UNISOC reference number

1. What does an * next to the Android bug ID in the References column mean?

Issues that are not publicly available have an * next to the corresponding reference ID. The update for that issue is generally contained in the latest binary drivers for Pixel devices available from the Google Developer site.

1. Why are security vulnerabilities split between this bulletin and device / partner security bulletins, such as the Pixel bulletin?

Security vulnerabilities that are documented in this security bulletin are required to declare the latest security patch level on Android devices. Additional security vulnerabilities that are documented in the device / partner security bulletins are not required for declaring a security patch level. Android device and chipset manufacturers may also publish security vulnerability details specific to their products, such as Google, Huawei, LGE, Motorola, Nokia, or Samsung.

---

Related vulnerabilities: CVE-2024-38421CVE-2024-38403CVE-2024-29779CVE-2024-43083CVE-2024-43081CVE-2024-38415CVE-2024-40660CVE-2024-40661CVE-2024-21455CVE-2024-43085CVE-2024-20104CVE-2024-43084CVE-2024-46740CVE-2024-23385CVE-2023-35686CVE-2024-43047CVE-2024-43093CVE-2024-31337CVE-2024-34729CVE-2024-38405CVE-2024-38424CVE-2024-23715CVE-2024-38422CVE-2024-38423CVE-2024-43090CVE-2024-43082CVE-2024-40671CVE-2024-43091CVE-2024-34747CVE-2024-20106CVE-2024-43086CVE-2023-35659CVE-2024-38402CVE-2024-36978CVE-2024-38408CVE-2024-43087CVE-2024-43080CVE-2024-34719CVE-2024-43089CVE-2024-43088

HPE Aruba Networking has released software patches for Access Points running Instant AOS-8 and AOS-10 that address multiple security vulnerabilities.

Reference - https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04722.txt

---

Related vulnerabilities: CVE-2024-47462CVE-2024-47460CVE-2024-42509CVE-2024-47464CVE-2024-47461CVE-2024-47463

Mozilla Foundation Security Advisory 2024-55 Security Vulnerabilities fixed in Firefox 132

Security Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2024-55/

• CVE-2024-10458: Permission leak via embed or object elements
• CVE-2024-10459: Use-after-free in layout with accessibility
• CVE-2024-10460: Confusing display of origin for external protocol handler prompt
• CVE-2024-10461: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
• CVE-2024-10462: Origin of permission prompt could be spoofed by long URL
• CVE-2024-10463: Cross origin video frame leak
• CVE-2024-10468: Race conditions in IndexedDB
• CVE-2024-10464: History interface could have been used to cause a Denial of Service condition in the browser
• CVE-2024-10465: Clipboard "paste" button persisted across tabs
• CVE-2024-10466: DOM push subscription message could hang Firefox
• CVE-2024-10467: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4

---

Related vulnerabilities: CVE-2024-10467CVE-2024-10465CVE-2024-10461CVE-2024-10464CVE-2024-10459CVE-2024-10462CVE-2024-10460CVE-2024-10458CVE-2024-10466CVE-2024-10463CVE-2024-10468

NVIDIA has released a software security update for NVIDIA GPU Display Driver to address various issues.

CVE‑2024‑0126 - "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."

---

Related vulnerabilities: CVE-2024-0119CVE-2024-0126CVE-2024-0118CVE-2024-0127CVE-2024-0121CVE-2024-0117CVE-2024-0128CVE-2024-0120

Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA | FortiGuard Labs

Reference: https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa

Affected Platforms: Ivanti Cloud Services Appliance version 4.6 and prior Impacted Users: Any organization Impact: Remote attackers gain control of the vulnerable systems Severity Level: Critical

Today FortiGuard Labs is releasing this blog post about a case where an advanced adversary was observed exploiting three vulnerabilities affecting the Ivanti Cloud Services Appliance (CSA). At the time of our investigation, two out of the three identified vulnerabilities were not publicly known. This incident is a prime example of how threat actors chain zero-day vulnerabilities to gain initial access to a victim’s network. Background

In a recent incident response engagement, FortiGuard Incident Response (FGIR) services were engaged by a customer to investigate malicious communication originating from their network. During the investigation, FGIR came across an adversary who had gained access to the customer’s network by exploiting the CVE-2024-8190 and two previously unknown vulnerabilities affecting the PHP front end of the Ivanti CSA appliance.

---

Related vulnerabilities: CVE-2024-29824CVE-2024-9380CVE-2024-8190CVE-2024-8963