Michael Schwarz

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 147.0.1 Thunderbird versions prior to 140.7.1 **Description** A flaw exists that could allow for CSS-based exfiltration of content from partially encrypted emails when remote content is permitted. This could potentially compromise the confidentiality of email communications. **Recommendations** Update Thunderbird to version 147.0.1 or later. Update Thunderbird to version 140.7.1 or later.

**Name of the Vulnerable Software and Affected Versions** T-Head XuanTie C910 CPU in the TH1520 SoC (affected versions not specified) T-Head XuanTie C920 CPU in the SOPHON SG2042 (affected versions not specified) **Description** The issue allows unprivileged attackers to write to arbitrary physical memory locations. This is due to certain instructions in the T-Head XuanTie C910 CPU and the T-Head XuanTie C920 CPU. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SCONE Confidential Computing Platform versions prior to 5.8.0 **Description** An issue was discovered in the SCONE Confidential Computing Platform, where the lack of pointer-alignment logic in ` scone dispatch` and other entry functions allows a local attacker to access unauthorized information, also known as an "AEPIC Leak". This issue affects the Intel SGX platform. **Recommendations** For versions prior to 5.8.0, update to version 5.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ` scone dispatch` function and other affected entry functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) **Description** The issue concerns improper or unexpected behavior of the INVD instruction in some AMD CPUs, potentially allowing an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU. This could lead to a loss of guest virtual machine (VM) memory integrity. The vulnerability, known as CacheWarp, affects AMD's Secure Encrypted Virtualization (SEV) technology, which is designed to protect against malicious hypervisors and reduce the attack surface of virtual machines by encrypting data. CacheWarp can be exploited to escalate privileges, execute remote code, and bypass authentication in virtual machines. The attack involves manipulating cache lines and exploiting the INVD instruction to alter the behavior of the CPU, potentially allowing attackers to gain control over virtual machines and access sensitive data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD processors (affected versions not specified) ARM processors (affected versions not specified) Intel processors (affected versions not specified) **Description** A potential power side-channel vulnerability may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time, potentially resulting in a leak of sensitive information. The vulnerability, known as Collide+Power, can be exploited to obtain confidential data, such as passwords or encryption keys. It is estimated that almost all modern processors are affected, including those from AMD, ARM, and Intel. However, the vulnerability is considered difficult to exploit, and the speed of data leakage is relatively low, making it unlikely to be used for attacks on end-users. The vulnerability can be used to enhance other software side-channel attacks, such as PLATYPUS and Hertzbleed. **Recommendations** As a temporary workaround, consider disabling the performance enhancement features in affected processors to minimize the risk of exploitation. Restrict access to sensitive data and confidential information to prevent potential leaks. Avoid using vulnerable processors for sensitive applications until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors versions 10 through 12 Intel(R) Processors (affected versions not specified) **Description** The issue is related to improper isolation of shared resources in some Intel(R) Processors, which may allow a privileged user to potentially enable information disclosure via local access. This is caused by an architectural flaw that allows access to uninitialized data left in the Advanced Programmable Interrupt Controller (APIC) registers after previous operations. The problem affects systems using the Software Guard Extensions (SGX) technology. **Recommendations** For Intel(R) Processors versions 10 through 12: Update microcode packages to fix the security vulnerability. For Intel(R) Processors (affected versions not specified): At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zammad version 5.2.0 **Description** The issue allows customers with secondary organizations assigned to view all organizations in the system, rather than only those they are assigned to. **Recommendations** For Zammad version 5.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AMD CPUs (affected versions not specified) **Description** A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information. This issue is related to a Meltdown-type attack, which was initially thought not to affect AMD processors. The attack may allow an attacker to disclose kernel address space information using a side channel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.14.x **Description** The issue allows guest OS administrators to obtain sensitive information, such as AES keys from outside the guest, via a side-channel attack on a power/energy monitoring interface, also known as a "Platypus" attack. **Recommendations** To resolve the issue, change the access control for each power/energy monitoring interface in Xen.

**Name of the Vulnerable Software and Affected Versions** Intel(R) Processors (affected versions not specified) **Description** The issue is related to cleanup errors in some data cache evictions for some Intel(R) Processors, which may allow an authenticated user to potentially enable information disclosure via local access. This is caused by a data leak from the L1D cache. The vulnerability can be exploited to disclose protected information. Researchers have found a new speculative execution vulnerability in Intel CPUs that could let attackers leak targeted sensitive data from the OS kernel, co-resident virtual machines, and even from Intel's secured SGX enclave. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Intel microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Data Sampling Uncacheable Memory (MDSUM) on some microprocessors that utilize speculative execution. This may allow an authenticated user with local access to potentially enable information disclosure via a side channel. An attacker with local access to a targeted system may exploit this issue to obtain data on the targeted system, causing some information leakage. **Recommendations** For Intel microprocessors, apply the microcode updates as guided by Intel. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.

**Name of the Vulnerable Software and Affected Versions** Intel Microprocessors (affected versions not specified) vCenter Server (affected versions not specified) ESXi (affected versions not specified) Workstation (affected versions not specified) Fusion (affected versions not specified) **Description** The issue is related to Microarchitectural Fill Buffer Data Sampling (MFBDS), which may allow an authenticated user to potentially enable information disclosure via a side channel with local access. This is due to the speculative execution utilized by some microprocessors. **Recommendations** For Intel Microprocessors, consider applying the microcode updates as guided by Intel to mitigate the risk. For vCenter Server, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For ESXi, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Workstation, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities. For Fusion, update to a version that includes Hypervisor-Specific Mitigations for MDS speculative execution vulnerabilities.