This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.
Adobe RoboHelp Server is a help authoring tool
Adobe Photoshop is a graphics editor
Adobe Acrobat and Reader are used to view, create, print, and mange PDF files
Adobe Character and Animator is a desktop application software product that combines real-time motion-capture with a multi-track recording system to control layered 2D puppets drawn in Photoshop or Illustrator.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
kernel-5.18.11-100.fc35
The 5.18.11 stable kernel update contains a number of important fixes across the tree. In addition to the 5.18.11 stable patches, this build contains the retbleed patches scheduled for 5.18.12 kernels.
kernel-5.18.11-200.fc36
The 5.18.11 stable kernel update contains a number of important fixes across the tree. In addition to the 5.18.11 stable patches, this build contains the retbleed patches scheduled for 5.18.12 kernels.
git-2.37.1-1.fc35
Update to 2.37.1 (CVE-2022-29187)
From the release notes for 2.30.5:
This release contains minor fix-ups for the changes that went into
Git 2.30.3 and 2.30.4, addressing CVE-2022-29187.
* The safety check that verifies a safe ownership of the Git
worktree is now extended to also cover the ownership of the Git
directory (and the `.git` file, if there is any).
Carlo Marcelo Arenas Belón (1):
setup: tighten ownership checks post CVE-2022-24765
Further details are available in the upstream advisory.
Additionally, from the release notes for 2.37.1:
* Rewrite of “git add -i” in C that appeared in Git 2.25 didn’t
correctly record a removed file to the index, which is an old
regression but has become widely known because the C version has
become the default in the latest release.
Last, but not least, are the usual bugfixes and improvements found since the 2.35 and 2.36 release. For details, refer to the release notes for 2.36.0 and 2.37.0.
git-2.37.1-1.fc36
Update to 2.37.1 (CVE-2022-29187)
From the release notes for 2.30.5:
This release contains minor fix-ups for the changes that went into
Git 2.30.3 and 2.30.4, addressing CVE-2022-29187.
* The safety check that verifies a safe ownership of the Git
worktree is now extended to also cover the ownership of the Git
directory (and the `.git` file, if there is any).
Carlo Marcelo Arenas Belón (1):
setup: tighten ownership checks post CVE-2022-24765
Further details are available in the upstream advisory.
Additionally, from the release notes for 2.37.1:
* Rewrite of “git add -i” in C that appeared in Git 2.25 didn’t
correctly record a removed file to the index, which is an old
regression but has become widely known because the C version has
become the default in the latest release.
Last, but not least, are the usual bugfixes and improvements found since the 2.36 release. For details, refer to the release notes for 2.37.0.
Multiple vulnerabilities have been discovered in Request Tracker, an
extensible trouble-ticket tracking system.
xen-4.16.1-6.fc36
Retbleed – arbitrary speculative code execution with return instructions
[XSA-407, CVE-2022-23816, CVE-2022-23825, CVE-2022-29900]
suricata-5.0.10-1.el8
This update fixes many bugs some of which are security relevant.
