[TLP:CLEAR] Přehled zajímavých zranitelností
Níže naleznete přehled zajímavých zranitelností, kterým jsme se nestihli věnovat blíže: Acronis opravuje vysoce závažnou zranitelnost v produktech Acronis Backup plugin for cPanel & WHM (Linux), Acronis Backup extension for Plesk (Linux) a Acronis Backup plugin for DirectAdmin (Linux) [1]. CheckPoint opravuje kritickou zranitelnost v produktu Check Point Security Management and Log Servers [2]. Dell opravuje více zranitelností ve svých produktech [3]. Drupal opravuje řadu zranitelností ve svých produktech [4]. GNU libextractor verzí 1.15 opravuje vysoce závažnou zranitelnost [5]. PoC naleznete na [6]. Google Chrome/Chromium ve verzích 153.0.8010.52/.53 pro Windows a Mac a 153.0.8010.52 pro Linux opravuje řadu zranitelností [7]. Grafana Labs opravuje verzemi 12.3.0, 13.0.0, 13.1.0, 13.2.0 a 13.2.2 vysoce závažnou zranitelnost v produktu Geomap MapLibre XSS [8]. Imager verzí 1.036 opravuje 2 zranitelnosti [9][10]. Jenkins opravuje 20 zranitelností [11]. Jetty opravuje verzemi balíčků org.eclipse.jetty.http2:http2-common (11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.http2:jetty-http2-common (12.1.11, 12.1.12), org.eclipse.jetty:jetty-http (12.1.12, 12.0.38, 11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.websocket:websocket-core-common (12.1.12, 12.0.38, 11.0.32, 10.0.32) 3 zranitelnosti [12][13][14]. Linux opravuje kritickou zranitelnost "guest-to-host escape" v KVM modulu jádra [15]. Patch naleznete na [16]. Linux opravuje zranitelnosti DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) a DiagSpill (CVE-2026-74469) umožňující lokální získání oprávnění uživatele root [17]. PoC naleznete na [18][19][20][21]. Neuvector verzemi 5.6.2, 5.5.4 a 5.4.11 opravuje 5 zranitelností v balíčku Go [22][23][24][25][26]. Nextcloud opravuje zranitelnost v produktech Nextcloud a Nextcloud Enterprise [27]. NoMachine opravuje 3 zranitelnosti [28][29][30]. Oracle opravuje v rámci Patch Tuesday řadu zranitelností ve svých produktech [31]. Rabbitmq-c opravuje verzí 0.18.0 vysoce závažnou zranitelnost [32]. Red Hat opravuje řadu zranitelností ve svých produktech [33]. SSH.NET (.NET knihovna) verzí 2026.0.0 opravuje 4 zranitelnosti [34][35][36][37]. Synology opravuje 8 zranitelností v produktu DSM [38]. WordPress vydal verzi 7.1.1, která opravuje 11 zranitelností [39].
Odkazy
- [1] https://security-advisory.acronis.com/advisories/SEC-10986
- [2] https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409
- [3] https://www.dell.com/support/security/cs-cz
- [4] https://www.drupal.org/security
- [5] https://www.openwall.com/lists/oss-security/2026/09/16/16
- [6] https://github.com/Haitam-lazaar/libextractor-ole2-rce
- [7] https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html
- [8] https://grafana.com/security/security-advisories/cve-2026-76154/
- [9] https://github.com/tonycoz/imager/security/advisories/GHSA-j7v7-cm4g-vrgf
- [10] https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
- [11] https://www.jenkins.io/security/advisory/2026-09-16/
- [12] https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
- [13] https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h
- [14] https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
- [15] https://www.openwall.com/lists/oss-security/2026/09/16/14
- [16] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8053393680d4fa3eb962667d2be95dd39f0940e5
- [17] https://heyitsas.im/posts/lpe-quartet/
- [18] https://github.com/manizada/DirtyAH6
- [19] https://github.com/manizada/TUNderflow
- [20] https://github.com/manizada/PPPoEject
- [21] https://github.com/manizada/DiagSpill
- [22] https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx
- [23] https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm
- [24] https://github.com/neuvector/neuvector/security/advisories/GHSA-wcx5-mq6c-c54j
- [25] https://github.com/neuvector/neuvector/security/advisories/GHSA-wgg5-24xq-px35
- [26] https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj
- [27] https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hwf-8pcj-33h4
- [28] https://www.zerodayinitiative.com/advisories/ZDI-26-712/
- [29] https://www.zerodayinitiative.com/advisories/ZDI-26-711/
- [30] https://www.zerodayinitiative.com/advisories/ZDI-26-710/
- [31] https://www.oracle.com/security-alerts/cspusep2026.html
- [32] https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-5fp7-wg2f-hhgp
- [33] https://access.redhat.com/security/security-updates/security-advisories?q=&p=1&sort=portal_update_date+desc&rows=10&portal_advisory_type=Security+Advisory&documentKind=Errata
- [34] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-h5q6-2gr6-3g3m
- [35] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-vhpg-4g9v-rppq
- [36] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284
- [37] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-mggc-4xg6-vcxf
- [38] https://www.synology.com/en-us/security/advisory/Synology_SA_26_13
- [39] https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
Za CESNET-CERTS Táňa Macháčková dne 18. 9. 2026.
