December 2023 Vulnerability Review

Hey, Vulnerability Watchers!

Welcome to 2024! It’s a new year, with new opportunities to find and manage vulnerabilities and to keep your business IT and data safe and secure.

Remember that this newsletter is free! Subscribe and share with your friends and colleagues, so they can quickly identify and remedy vulnerabilities in their environments as well.

And as always, check out our Vulnerability Dashboard to find a complete list of new vulnerabilities, monitor vulnerability trends, see criticality scores, and get CVE-IDs and vulnerability descriptions.

Let’s get started!

---

December saw fewer vulnerabilities and fewer affected vendors, products, and versions, down to 10,821 from 12,565 in November. Although this might seem like good news, the total number of vulnerabilities is still concerningly high, and we shouldn’t let this momentary drop lull us into a false sense of security.

Vulnerabilities were spread among several different vendors last month, but Google, Adobe, Siemens, and Dell stood out, accounting for about two-thirds of December’s total.

Google’s Android and Adobe’s Experience Manager ran neck-in-neck for the most vulnerabilities per product, with Android at 196 and Experience Manager at 198.

While most of Android’s vulnerabilities have a medium criticality score, 79 of them have a score of 8 or higher, meaning that if exploited, these vulnerabilities could have a significant impact on your infrastructure and data security.

The most critical Android vulnerabilities all allow for the possibility of arbitrary code execution that could lead to local escalation of privilege in the kernel. This could grant bad actors privileges they shouldn’t have to insert malicious code into your systems.

The Experience Manager vulnerabilities have a high medium criticality score, but they run the risk of being abused by low-privileged attackers to inject malicious scripts into vulnerable form fields that can then be executed in a victim’s browser.

Here are some of the most critical vulnerabilities from December:

CVE-2023-21164

Publisher: Google

Product: Android

Description: In DevmemIntMapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-29487

Publisher: Heimdal Security

Product: Thor

Description: An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to cause a denial of service (DoS) via the Threat To Process Correlation threat prevention module.

CVE-2023-46223

Publisher: Ivanti

Product: Avalanche

Description: An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or code execution.

---

Patches can be found at our Package Store.

We’ll be back again in February with more Vulnerability News.

Thanks for reading!

?