Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. Certain custom configuration settings (GUCs) for PL/Java will now be modifiable only by the database superuser to mitigate this issue. CVE-2016-0773 Tom Lane and Greg Stark discovered a flaw in the way PostgreSQL […]
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt() function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. […]
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details. For the stable distribution (jessie), this problem has been fixed in version 1.6.3-2+deb8u1. For the unstable distribution (sid), this problem has been […]
Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the resolver directive is used in a configuration file. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.1-2.2+wheezy4. For the […]
Two vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2221 Shailesh Suthar discovered an open redirection vulnerability. CVE-2016-2222 Ronni Skansing discovered a server-side request forgery (SSRF) vulnerability. For the oldstable distribution (wheezy), these problems have been fixed in version 3.6.1+dfsg-1~deb7u10. For the stable distribution […]
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the […]
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]
It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service (via application crash) or arbitrary code execution. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.9-1~deb7u6. For the stable distribution (jessie), these problems […]
Discovered: February 12, 2016 Updated: February 12, 2016 7:53:04 PM Type: Trojan Systems Affected: Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista, Windows XP Backdoor.Fimlis is a Trojan horse that opens a back door on the compromised computer and downloads potentially malicious files. […]
Discovered: February 10, 2016 Updated: February 12, 2016 12:02:31 PM Type: Trojan Infection Length: Varies Systems Affected: Windows 2000, Windows 7, Windows Vista, Windows XP Trojan.Ransomcrypt.AC is a Trojan horse that encrypts files on the compromised computer. Antivirus Protection Dates Initial Rapid Release version February 10, 2016 revision 119 Latest Rapid Release version February 11, […]
APPLE-SA-2016-01-19-3 Safari 9.0.3 Subject: APPLE-SA-2016-01-19-3 Safari 9.0.3 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:48:17 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-3 Safari 9.0.3 Safari 9.0.3 is now available and addresses the following: WebKit Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, OS X El Capitan v10.11 to v10.11.2 […]
APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 Subject: APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:46:58 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 OS X El Capitan 10.11.3 and […]
APPLE-SA-2016-01-19-1 iOS 9.2.1 Subject: APPLE-SA-2016-01-19-1 iOS 9.2.1 From: Apple Product Security <email@hidden> Date: Tue, 19 Jan 2016 15:43:37 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-1 iOS 9.2.1 iOS 9.2.1 is now available and addresses the following: Disk Images Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later […]
APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security <email@hidden> Date: Thu, 07 Jan 2016 17:40:44 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted […]
APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security <email@hidden> Date: Thu, 07 Jan 2016 16:07:02 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks […]
Risk High Date Discovered February 9, 2016 Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft Windows 10 for 32-bit Systems Microsoft […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause […]
Risk Medium Date Discovered February 9, 2016 Description Microsoft ASP.NET is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks. Technologies Affected Microsoft ASP.NET MVC 5.0 Microsoft ASP.NET MVC 6.0 Microsoft […]
Risk Medium Date Discovered February 9, 2016 Description Microsoft Active Directory Federation Services is prone to a denial of service vulnerability. Successful exploits may allow the attacker to cause the server to become non-responsive, resulting in denial of service conditions. Technologies Affected Microsoft Active Directory Federation Services 3.0 Microsoft Windows Server 2012 R2 Recommendations Block […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Internet Explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft Internet […]
Risk High Date Discovered February 9, 2016 Description Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Successful exploits may aid in further attacks. Internet Explorer 9, 10 and 11 are vulnerable. Technologies Affected Microsoft Internet Explorer 10 Microsoft Internet Explorer 11 Microsoft Internet […]
APPLE-SA-2016-01-25-1 tvOS 9.1.1 Subject: APPLE-SA-2016-01-25-1 tvOS 9.1.1 From: Apple Product Security Date: Mon, 25 Jan 2016 11:36:06 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-25-1 tvOS 9.1.1 tvOS 9.1.1 is now available and addresses the following: Disk Images Available for: Apple TV (4th generation) Impact: A local user may be able to execute arbitrary code […]
APPLE-SA-2016-01-19-3 Safari 9.0.3 Subject: APPLE-SA-2016-01-19-3 Safari 9.0.3 From: Apple Product Security Date: Tue, 19 Jan 2016 15:48:17 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-3 Safari 9.0.3 Safari 9.0.3 is now available and addresses the following: WebKit Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, OS X El Capitan v10.11 to v10.11.2 Impact: […]
APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 Subject: APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 From: Apple Product Security Date: Tue, 19 Jan 2016 15:46:58 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-2 OS X El Capitan 10.11.3 and Security Update 2016-001 OS X El Capitan 10.11.3 and Security […]
APPLE-SA-2016-01-19-1 iOS 9.2.1 Subject: APPLE-SA-2016-01-19-1 iOS 9.2.1 From: Apple Product Security Date: Tue, 19 Jan 2016 15:43:37 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-19-1 iOS 9.2.1 iOS 9.2.1 is now available and addresses the following: Disk Images Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: […]
APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security Date: Thu, 07 Jan 2016 17:40:44 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie […]
APPLE-SA-2016-01-07-1 QuickTime 7.7.9 Subject: APPLE-SA-2016-01-07-1 QuickTime 7.7.9 From: Apple Product Security Date: Thu, 07 Jan 2016 16:07:02 -0800 —–BEGIN PGP SIGNED MESSAGE—– Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an […]
Holger Fuhrmannek discovered that missing input sanitising in the Graphite font rendering engine could result in the execution of arbitrary code. For the oldstable distribution (wheezy), this problem has been fixed in version 38.6.1esr-1~deb7u1. For the stable distribution (jessie), this problem has been fixed in version 38.6.1esr-1~deb8u1. For the unstable distribution (sid), this problem has […]
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. Certain custom configuration settings (GUCs) for PL/Java will now be modifiable only by the database superuser to mitigate this issue. CVE-2016-0773 Tom Lane and Greg Stark discovered a flaw in the way PostgreSQL […]
Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-5288 Josh Kupershmidt discovered a vulnerability in the crypt() function in the pgCrypto extension. Certain invalid salt arguments can cause the server to crash or to disclose a few bytes of server memory. CVE-2016-0766 A privilege escalation vulnerability for users of PL/Java was discovered. […]
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details. For the stable distribution (jessie), this problem has been fixed in version 1.6.3-2+deb8u1. For the unstable distribution (sid), this problem has been […]
Several vulnerabilities were discovered in the resolver in nginx, a small, powerful, scalable web/proxy server, leading to denial of service or, potentially, to arbitrary code execution. These only affect nginx if the resolver directive is used in a configuration file. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.1-2.2+wheezy4. For the […]
Two vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-2221 Shailesh Suthar discovered an open redirection vulnerability. CVE-2016-2222 Ronni Skansing discovered a server-side request forgery (SSRF) vulnerability. For the oldstable distribution (wheezy), these problems have been fixed in version 3.6.1+dfsg-1~deb7u10. For the stable distribution […]
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service, that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. discovered that the […]
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]
Several vulnerabilities were discovered in qemu, a full virtualization solution on x86 hardware. CVE-2015-7295 Jason Wang of Red Hat Inc. discovered that the Virtual Network Device support is vulnerable to denial-of-service (via resource exhaustion), that could occur when receiving large packets. CVE-2015-7504 Qinghao Tang of Qihoo 360 Inc. and Ling Liu of Qihoo 360 Inc. […]
It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service (via application crash) or arbitrary code execution. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.9-1~deb7u6. For the stable distribution (jessie), these problems […]
Note: This blog article expands on some of the content that originally appeared in a lengthy article on support scams for ITSecurity UK, and subsequently in an article for the ESET Threat Report for December 2015. I’m returning to the theme of what to do if a scammer actually gets a foothold on your system, […]
��}��8��o;���’,�-R��R}Y��e�w���u�* ��H��R�1�qq���”� ��d��2�)J%�d��Ξi�”�D”��H$�w��:9����dz����~0��q�;�i��:Ո��}�Ӽ��D��hxcߘ���ՠέF��-x��=����:�ۗ=��s#�F���g�_=-bWQ�쁣�z�Ǭ1�Wu��K��|/���3ۊ&=�]�C��ub�vdSG��a=������C;b�%�=Dh�����zA�u^��X�������k��c���U�ixIۢ3�������A��Q��=i����f��?���q��#�-`�`:�{A��0�;,�0������0�ȔY6�i~`��u����f3c��lv47�1�u�T#��)�Ck�t���E�����:9��!A����#{j��,2�� `D’�� �#��:%/��:dbG��?��u-o �Bo:�#4����ACT��R�b�0���0=ʀ�.o�C�”�qH�R�.yd;Μ�ᐅ!,�~����0b�:�%3�.��|�hrj�� A�bw8�n�E� ��fC5���O9�E�iv�V��kġ�tHj�Jz֢.Zl�H��� �s�v���� h8p>j�ñ�t��fE�ƾ�Q+L�����7:�^l���J�B�E ]�GCXJ�a��5���3�|泩��>eQd����Gm@C�(�#��_�6Bcfx���’I�kc�����kc�u����5h ��;��C�}Ԡ3`���*�rB����ݡ[����u��`g�Ç����2�O���[wF�(.UZԇ���obUi��%� Ne���ɍ�8�u�Z�� �1���|ݻ���j-K�,�w�e�@����êe`�ǀ�Hs���P����[�y�e�9��{�Ŋ ��i6�������bս��^���=0[��_�7��Z}hD�џ��14̟`0���S�� x���:��1�W��’�q�qz)��>��X/i���/�W��߫�0�e=��.>�A�,xX]|Wՠe�J{�YZ}�c�괤,��FJ���BU�s�����±#.X��� �NE:=9Ų��b�j@f�!����S}d(���Us�kG#Cj�{�FF4��U,’���C���j��BW�-o#�ԗ�j� �V}�q)Tm�o��1��é�y�����۷,;�:?��%�܁�q�n�^`��&�>�P��?�~ V��j��-+Ķzχ%���a ��@� k���s���`�� q��{�ꃹ��o�S��Em��+bx+��V�b���G^Xp��� 6`Bn��{�t�%i�h�.��fטKߎ�F4v���2����.��o�z��BLQD�7��~����~2fwd�e�#�t,`����Y��*}udx^F�w�:CS�|Ű3LGԅ��w�;D��Y07�U��ػw��>8� ��6����L/���h��`wx�`�^�n�,����]|�P���f:5��{�(��M�k���,��%8 CW�ZԿmd��D-�{9 [x9�9�Y��z���m�X���:^ptw���SMO�yQ)�+���2q4�’��H��r�i�*�l��y�է�8��$�s����2 xύ�ϻ��|v����V�K%lL�KPj�GF��m��~�M4`m���4�iy� T�_-�-ls���nƽ�7�j�����l5]���˿d�N��Z ���1a��pʢ�g�T���O����!@5�Am�7��� P’b�K�����r�߬�5ݦ8Tg��F��ȡ�6�si�T�’���1���������ԁO�^t�7���e4��Y�Ό�Uh�߃8pqb��p�8w��P�j�܍��|A�GÉh�T��=y9����BЫu>| =�88��ￓ��G��*�T��[����6X��MX�H��#��A�+C�1���+�H��0V���”��/�>��x�(��m�K���0�_z3@�� z�F^��J��� ����~N�o+Բ^�W�yfU�b����v�VV�”��Vy�F��b���9�hK5�>;���I6��;��z��{:&�g��L��0 |��i�,��_:x4>;p^�d�Ã��O���G��1���N��D.o��`LI���N��bٗ��G=��y^��`��P�3�`���b�D9/�� {��ϟYUV#� �IPy�ր���`[��d`m%����ݫ�`���{0=�Б�e�hkྔ/e�pp?�3 ��nxJZ�߇�R�V;Vx�o����yA]XJ���@(1�b�EDLD�SQ��ԃ��׳��O�z�B��v�Y͔���,u|i���v@oMl˂y�Z4��Ł�խzXw�v������;�>�XGS&� �}w�e3���Z�?��ju��#^� L���VqN���{��P���s�W���h�WV��9�T������=߰��vemFH��}����3E}�����N�B�^�ƪ��O]k)�� A�:4{�̥���?侠@�� �� ��}��8��o;���’,�-R��R}Y��e�w���u�* ��H��R�1�qq���”� ��d��2�)J%�d��Ξi�”�D”��H$�w��:9����dz����~0��q�;�i��:Ո��}�Ӽ��D��hxcߘ���ՠέF��-x��=����:�ۗ=��s#�F���g�_=-bWQ�쁣�z�Ǭ1�Wu��K��|/���3ۊ&=�]�C��ub�vdSG��a=������C;b�%�=Dh�����zA�u^��X�������k��c���U�ixIۢ3�������A��Q��=i����f��?���q��#�-`�`:�{A��0�;,�0������0�ȔY6�i~`��u����f3c��lv47�1�u�T#��)�Ck�t���E�����:9��!A����#{j��,2�� `D’�� �#��:%/��:dbG��?��u-o �Bo:�#4����ACT��R�b�0���0=ʀ�.o�C�”�qH�R�.yd;Μ�ᐅ!,�~����0b�:�%3�.��|�hrj�� A�bw8�n�E� ��fC5���O9�E�iv�V��kġ�tHj�Jz֢.Zl�H��� �s�v���� h8p>j�ñ�t��fE�ƾ�Q+L�����7:�^l���J�B�E ]�GCXJ�a��5���3�|泩��>eQd����Gm@C�(�#��_�6Bcfx���’I�kc�����kc�u����5h ��;��C�}Ԡ3`���*�rB����ݡ[����u��`g�Ç����2�O���[wF�(.UZԇ���obUi��%� Ne���ɍ�8�u�Z�� �1���|ݻ���j-K�,�w�e�@����êe`�ǀ�Hs���P����[�y�e�9��{�Ŋ […]