Sophos IPS and Application Signature update release notes

Version 18.23.18

Released on April 1, 2025

Introduction

The Release Note document for IPS and Application signature Database version 18.23.18 includes support for both, the new and the updated Signatures. The following sections describe the release in detail.

Release Information

Upgrade Applicable on: Version 18.23.17

Fixed issues, listed by ID, description, explanation and Workaround.

Appliance Model	Details of Changes			Module	More Details
All Deployments	7 Applications	12 Application Signatures	4 Application categories	Application Filter	Click Here for details of changes
XGS-87, XGS-87(w), XGS-107, XGS-107(w), XGS-116, XGS-116(w), XGS-126, XGS-126(w), XGS-136, XGS-136(w), XGS-2100, XGS-2300, XGS-3100, XGS-3300, XGS-4300, XGS-4500 XG-86, XG-86(w), XG-106, XG-106(w), XG-115, XG-115(w), XG-125, XG-125(w), XG-135, XG-135(w), XG-210, XG-230, XG-310, XG-330, XG-430, XG-450 SG-105, SG-105(w), SG-115, SG-115(w), SG-125, SG-125(w), SG-135, SG-135(w), SG-210, SG-230, SG-310, SG-330, SG-430, SG-450, SG-550, SG-650 Any virtual deployment with RAM < 24GB	27 Signatures	23 Vulnerabilities	9 IPS Categories	IPS Filter	Click Here for details of changes
XG-550, XG-650, XG-750 XGS-5500, XGS-6500 Any virtual deployment with RAM >24GB	27 Signatures	23 Vulnerabilities	9 IPS Categories	IPS Filter	Click Here for details of changes

Application Name	Risk	Category
Red Bull TV	1	Streaming Media
ABC Web Player	3	Streaming Media
Cienradios Streaming	1	Streaming Media
VidibleTV	1	Streaming Media
X-VPN	5	Proxy and Tunnel
Xiaohongshu	1	Social Networking
Way2news	1	General Internet

Application Name

Risk

Risk Level	Risk Criteria
1	Very Low
2	Low
3	Medium
4	High
5	Very High

Name	CVE-ID	Category	Severity
BROWSER-CHROME Google Chrome NavigationURLLoaderImpl CVE-2023-6112 Use-After-Free Attempt	CVE-2023-6112	browser-chrome	1
BROWSER-CHROME Google Chrome V8 engine memory corruption attempt	CVE-2024-7965	browser-chrome	2
BROWSER-IE Microsoft Internet Explorer center element dynamic manipulation attempt	CVE-2012-1523	browser-ie	2
BROWSER-PLUGINS Attachmate Reflection FTP Client ActiveX clsid access attempt	CVE-2014-0603	browser-plugins	1
FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt	CVE-2020-8844	file-image	1
FILE-OTHER ERDAS ERS Viewer ERM_convert_to_correct_webpath buffer overflow attempt	CVE-2013-0726	file-other	1
FILE-OTHER Microsoft Windows SmartScreen Security CVE-2023-36025 Bypass Attempt	CVE-2023-36025	file-other	2
OS-WINDOWS Microsoft Windows potential malicious Shortcut file download attempt	CVE-2023-32046, CVE-2023-36025, CVE-2024-43451, CVE-2025-21377	os-windows	1
OS-WINDOWS Microsoft Windows PPTP denial-of-service attempt	CVE-2022-23253	os-windows	5
SERVER-APACHE Apache Tomcat Partial PUT Path CVE-2025-24813 Remote Code Execution Vulnerability	CVE-2025-24813	server-apache	1
SERVER-OTHER IBM Tivoli Storage Manager Express CAD Host CVE-2007-4880 Buffer Overflow Attempt	CVE-2007-4880	server-other	1
SERVER-OTHER Nero MediaHome NMMediaServerService.dll CVE-2012-5876 Denial of Service Attempt	CVE-2002-2268, CVE-2012-5876	server-other	1
SERVER-WEBAPP Adobe ColdFusion invokeLoggingModule CVE-2024-53961 Directory Traversal	CVE-2024-53961	server-webapp	3
SERVER-WEBAPP Adobe Commerce and Magento template engine arbitrary command execution attempt	CVE-2022-24086	server-webapp	1
SERVER-WEBAPP Advantive VeraCore arbitrary file upload attempt	CVE-2024-57968	server-webapp	1
SERVER-WEBAPP Advantive VeraCore CVE-2025-25181 SQL Injection Attempt	CVE-2025-25181	server-webapp	2
SERVER-WEBAPP Aviatrix Controllers CVE-2024-50603 Command Injection Attempt	CVE-2024-50603	server-webapp	1
SERVER-WEBAPP Hitachi Vantara Pentaho Unauthenticated CVE-2022-43769 CVE-2022-43939 Code Execution Attempt	CVE-2022-43769, CVE-2022-43939	server-webapp	2
SERVER-WEBAPP Ivanti Endpoint Manager DPIDatabase GetComputerID CVE-2024-50330 SQL Injection	CVE-2024-50330	server-webapp	2
SERVER-WEBAPP Ivanti Endpoint Manager DPIDatabase GetComputerID CVE-2024-50330 SQL Injection	CVE-2024-50330	server-webapp	5
SERVER-WEBAPP MiniUPnPd ExecuteSoapAction memory corruption	CVE-2013-0230	server-webapp	2
SERVER-WEBAPP Rhinosoft Serv-U Session Cookie CVE-2009-4006 Buffer Overflow Attempt	CVE-2009-4006	server-webapp	1
SERVER-WEBAPP Zimbra Collaboration CancelPendingAccountOnlyRemoteWipe CVE-2025-25064 SQL Injection	CVE-2025-25064	server-webapp	1

Name	CVE-ID	Category	Severity
BROWSER-CHROME Google Chrome NavigationURLLoaderImpl CVE-2023-6112 Use-After-Free Attempt	CVE-2023-6112	browser-chrome	1
BROWSER-CHROME Google Chrome V8 engine memory corruption attempt	CVE-2024-7965	browser-chrome	2
BROWSER-IE Microsoft Internet Explorer center element dynamic manipulation attempt	CVE-2012-1523	browser-ie	2
BROWSER-PLUGINS Attachmate Reflection FTP Client ActiveX clsid access attempt	CVE-2014-0603	browser-plugins	1
FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt	CVE-2020-8844	file-image	1
FILE-OTHER ERDAS ERS Viewer ERM_convert_to_correct_webpath buffer overflow attempt	CVE-2013-0726	file-other	1
FILE-OTHER Microsoft Windows SmartScreen Security CVE-2023-36025 Bypass Attempt	CVE-2023-36025	file-other	2
OS-WINDOWS Microsoft Windows potential malicious Shortcut file download attempt	CVE-2023-32046, CVE-2023-36025, CVE-2024-43451, CVE-2025-21377	os-windows	1
OS-WINDOWS Microsoft Windows PPTP denial-of-service attempt	CVE-2022-23253	os-windows	5
SERVER-APACHE Apache Tomcat Partial PUT Path CVE-2025-24813 Remote Code Execution Vulnerability	CVE-2025-24813	server-apache	1
SERVER-OTHER IBM Tivoli Storage Manager Express CAD Host CVE-2007-4880 Buffer Overflow Attempt	CVE-2007-4880	server-other	1
SERVER-OTHER Nero MediaHome NMMediaServerService.dll CVE-2012-5876 Denial of Service Attempt	CVE-2002-2268, CVE-2012-5876	server-other	1
SERVER-WEBAPP Adobe ColdFusion invokeLoggingModule CVE-2024-53961 Directory Traversal	CVE-2024-53961	server-webapp	3
SERVER-WEBAPP Adobe Commerce and Magento template engine arbitrary command execution attempt	CVE-2022-24086	server-webapp	1
SERVER-WEBAPP Advantive VeraCore arbitrary file upload attempt	CVE-2024-57968	server-webapp	1
SERVER-WEBAPP Advantive VeraCore CVE-2025-25181 SQL Injection Attempt	CVE-2025-25181	server-webapp	2
SERVER-WEBAPP Aviatrix Controllers CVE-2024-50603 Command Injection Attempt	CVE-2024-50603	server-webapp	1
SERVER-WEBAPP Hitachi Vantara Pentaho Unauthenticated CVE-2022-43769 CVE-2022-43939 Code Execution Attempt	CVE-2022-43769, CVE-2022-43939	server-webapp	2
SERVER-WEBAPP Ivanti Endpoint Manager DPIDatabase GetComputerID CVE-2024-50330 SQL Injection	CVE-2024-50330	server-webapp	2
SERVER-WEBAPP Ivanti Endpoint Manager DPIDatabase GetComputerID CVE-2024-50330 SQL Injection	CVE-2024-50330	server-webapp	5
SERVER-WEBAPP MiniUPnPd ExecuteSoapAction memory corruption	CVE-2013-0230	server-webapp	2
SERVER-WEBAPP Rhinosoft Serv-U Session Cookie CVE-2009-4006 Buffer Overflow Attempt	CVE-2009-4006	server-webapp	1
SERVER-WEBAPP Zimbra Collaboration CancelPendingAccountOnlyRemoteWipe CVE-2025-25064 SQL Injection	CVE-2025-25064	server-webapp	1

Severity Level	Severity Criteria
1	Critical
2	Major
3	Moderate
4	Minor
5	Warning

Sophos IPS and Application Signature Update

These release notes are for Sophos IPS and Application signature updates.

Version 18.23.18
Released on April 1, 2025

Introduction

Release Information

Upgrade Information

Application Signatures

Terms Explained

IPS Signatures

IPS Signatures

Terms Explained

Important Notice

RESTRICTED RIGHTS

Corporate Headquarters