-
Oracle Critical Patch Update Advisory – January 2023 : Security Focus CVE-2022-2274 (17th JAN 2023)
Preface: Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Critical Patch Update security patches as soon possible. Background: AVX-512 debuted in 2016 on Intel’s Xeon Phi x200 (codenamed Knights Landing). However, the instruction set has since found its way into other products from the chipmaker, such as Skylake-SP, Skylake-X,…
-
CVE-2022-47630 – See whether your android can skip this vulnerability? Perhaps it can. (16th Jan 2023)
Preface: Why configure Secure Boot? This type of hardware restriction protects the operating system from rootkits and other attacks that may not be detected by antivirus software. Background: Secure Boot is the process where the operating system boot images and code are authenticated against the hardware before they are authorized to be used in the…
-
Security Focus (CVE-2023-0022) – This CVE is included in SAP’s first 2023 security update. (15th JAN 2023)
Preface: OLAP is all about BI and Big Data. Online analytical processing (OLAP) is an approach to formulate and answer multidimensional queries to large datasets. Background: SAP have released a new statement of direction for SAP BusinessObjectsthat introduces a new version of the SAP BusinessObjects BI suite code named SAP BusinessObjects BI 2024, available on-premises…
-
CVE‑2022‑42271 Staying alert, Artificial intelligence world! (12th Jan 2023)
Preface: An “intelligent” computer uses AI to think like a human and perform tasks on its own. Machine learning is how a computer system develops its intelligence. One way to train a computer to mimic human reasoning is to use a neural network, which is a series of algorithms that are modeled after the human…
-
Intel security advisory (AV23-015) 10th JAN 2023
Preface: OpenMP (Open Multi-Processing) is an application programming interface (API) that supports multi-platform shared-memory multiprocessing programming in C, C++, and Fortran, on many platforms, instruction-set architectures and operating systems, including Solaris, AIX, FreeBSD, HP-UX, Linux, macOS, and Windows. Background: A LEGO brick is a small plastic part, but it can build a big robot. Similar concept,…
-
CVE-2022-25746: Possible cause of this vulnerability in Snapdragon (9th JAN 2023)
Preface: Qualcomm’s current Snapdragon chips for smartphones are also based on Arm technology. The Snapdragon’s central processing unit (CPU) uses the ARM architecture. Some companies, like Apple, license the ISA from Arm, then design their own physical processor circuits to implement the ISA instructions. Other companies, like Qualcomm historically, also buy the rights to full…
-
CVE-2023-21420 Use of Externally-Controlled Format String vulnerabilities in STST TA (8th JAN 2023)
Preface: What is Samsung TEEGRIS? Samsung TEEGRIS is a system-wide security solution that allows you to run applications in a trusted execution environment based on TrustZone. We present the TEEGRIS architecture for external developers to enable their trusted applications and services. Background: TEEGRIS is a relatively recent TEE OS, introduced by Samsung on the Galaxy…
-
CVE-2022-45857 – FortiManager Incorrect user management (6th JAN 2023)
Preface: Every Fortinet product has a built-in administrator account. Background: Ten years ago, one of the key function is reset function in business contingency program. Refer to textbooks, the objective of disaster recovery is resume the service. So more terms created: Recovery Point Objective (RPO) Recovery Time Objective (RTO) Work Recovery Time (WRT) Maximum Tolerable…
-
CVE-2022-32635 – Improper input validation for GPS on mediatek chipsets (4th JAN 2023)
Preface: The Global Positioning System (GPS) employs trilateration to calculate the coordinates of positions at or near the Earth’s surface. Trilateration refers to the trigonometric law by which the interior angles of a triangle can be determined if the lengths of all three triangle sides are known. I have a set of coordinates, that I…
-
CVE-2022-42475 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN (2nd JAN 2023)
Preface: The SSL VPN must be exposed to the Internet. So you can use the service anywhere. This is a basic design. Fortinet has patched a zero day buffer overflow in FortiOS that could lead to remote code execution. There has been a report of active exploitation and organizations should patch urgently. (2 weeks ago…