Tento report bol preložený pomocou AI; preklad zatiaľ nikto neskontroloval. Pôvodný jazyk: čeština.
[TLP:CLEAR] Prehľad zaujímavých zraniteľností
nižšie nájdete prehľad zaujímavých zraniteľností, ktorým sme sa nestihli venovať bližšie: Acronis opravuje vysoko závažnú zraniteľnosť v produktoch Acronis Backup plugin for cPanel & WHM (Linux), Acronis Backup extension for Plesk (Linux) a Acronis Backup plugin for DirectAdmin (Linux) [1]. CheckPoint opravuje kritickú zraniteľnosť v produkte Check Point Security Management and Log Servers [2]. Dell opravuje viacero zraniteľností vo svojich produktoch [3]. Drupal opravuje rad zraniteľností vo svojich produktoch [4]. GNU libextractor verziou 1.15 opravuje vysoko závažnú zraniteľnosť [5]. PoC nájdete na [6]. Google Chrome/Chromium vo verziách 153.0.8010.52/.53 pre Windows a Mac a 153.0.8010.52 pre Linux opravuje rad zraniteľností [7]. Grafana Labs opravuje verziami 12.3.0, 13.0.0, 13.1.0, 13.2.0 a 13.2.2 vysoko závažnú zraniteľnosť v produkte Geomap MapLibre XSS [8]. Imager verziou 1.036 opravuje 2 zraniteľnosti [9][10]. Jenkins opravuje 20 zraniteľností [11]. Jetty opravuje verziami balíkov org.eclipse.jetty.http2:http2-common (11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.http2:jetty-http2-common (12.1.11, 12.1.12), org.eclipse.jetty:jetty-http (12.1.12, 12.0.38, 11.0.32, 10.0.32, 9.4.64), org.eclipse.jetty.websocket:websocket-core-common (12.1.12, 12.0.38, 11.0.32, 10.0.32) 3 zraniteľnosti [12][13][14]. Linux opravuje kritickú zraniteľnosť "guest-to-host escape" v module KVM jadra [15]. Patch nájdete na [16]. Linux opravuje zraniteľnosti DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) a DiagSpill (CVE-2026-74469) umožňujúce lokálne získanie oprávnení používateľa root [17]. PoC nájdete na [18][19][20][21]. Neuvector verziami 5.6.2, 5.5.4 a 5.4.11 opravuje 5 zraniteľností v balíku Go [22][23][24][25][26]. Nextcloud opravuje zraniteľnosť v produktoch Nextcloud a Nextcloud Enterprise [27]. NoMachine opravuje 3 zraniteľnosti [28][29][30]. Oracle opravuje v rámci Patch Tuesday rad zraniteľností vo svojich produktoch [31]. Rabbitmq-c opravuje verziou 0.18.0 vysoko závažnú zraniteľnosť [32]. Red Hat opravuje rad zraniteľností vo svojich produktoch [33]. SSH.NET (.NET knižnica) verziou 2026.0.0 opravuje 4 zraniteľnosti [34][35][36][37]. Synology opravuje 8 zraniteľností v produkte DSM [38]. WordPress vydal verziu 7.1.1, ktorá opravuje 11 zraniteľností [39].
Odkazy
- [1] https://security-advisory.acronis.com/advisories/SEC-10986
- [2] https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409
- [3] https://www.dell.com/support/security/cs-cz
- [4] https://www.drupal.org/security
- [5] https://www.openwall.com/lists/oss-security/2026/09/16/16
- [6] https://github.com/Haitam-lazaar/libextractor-ole2-rce
- [7] https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0194356994.html
- [8] https://grafana.com/security/security-advisories/cve-2026-76154/
- [9] https://github.com/tonycoz/imager/security/advisories/GHSA-j7v7-cm4g-vrgf
- [10] https://github.com/tonycoz/imager/security/advisories/GHSA-p4vw-rc54-p2c2
- [11] https://www.jenkins.io/security/advisory/2026-09-16/
- [12] https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
- [13] https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h
- [14] https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
- [15] https://www.openwall.com/lists/oss-security/2026/09/16/14
- [16] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8053393680d4fa3eb962667d2be95dd39f0940e5
- [17] https://heyitsas.im/posts/lpe-quartet/
- [18] https://github.com/manizada/DirtyAH6
- [19] https://github.com/manizada/TUNderflow
- [20] https://github.com/manizada/PPPoEject
- [21] https://github.com/manizada/DiagSpill
- [22] https://github.com/neuvector/neuvector/security/advisories/GHSA-c6rx-pmvf-m3jx
- [23] https://github.com/neuvector/neuvector/security/advisories/GHSA-78r4-3wfq-r2xm
- [24] https://github.com/neuvector/neuvector/security/advisories/GHSA-wcx5-mq6c-c54j
- [25] https://github.com/neuvector/neuvector/security/advisories/GHSA-wgg5-24xq-px35
- [26] https://github.com/neuvector/neuvector/security/advisories/GHSA-vr77-8vmq-qfmj
- [27] https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7hwf-8pcj-33h4
- [28] https://www.zerodayinitiative.com/advisories/ZDI-26-712/
- [29] https://www.zerodayinitiative.com/advisories/ZDI-26-711/
- [30] https://www.zerodayinitiative.com/advisories/ZDI-26-710/
- [31] https://www.oracle.com/security-alerts/cspusep2026.html
- [32] https://github.com/alanxz/rabbitmq-c/security/advisories/GHSA-5fp7-wg2f-hhgp
- [33] https://access.redhat.com/security/security-updates/security-advisories?q=&p=1&sort=portal_update_date+desc&rows=10&portal_advisory_type=Security+Advisory&documentKind=Errata
- [34] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-h5q6-2gr6-3g3m
- [35] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-vhpg-4g9v-rppq
- [36] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284
- [37] https://github.com/sshnet/SSH.NET/security/advisories/GHSA-mggc-4xg6-vcxf
- [38] https://www.synology.com/en-us/security/advisory/Synology_SA_26_13
- [39] https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
Za CESNET, z.s.p.o. Táňa Macháčková dňa 18. 9. 2026.