Menu

Monthly Archives: July 2019

An update that fixes two vulnerabilities is now available.

An update that fixes 20 vulnerabilities is now available.

An update that solves three vulnerabilities and has 5 fixes is now available.

This update upgrades Thunderbird to version 60.8.0. * Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709) * Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811) * Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711) * Mozilla: Cross-origin POST requests can be made with NPAPI plugins by […]

Bust the password for an air-gapped machine – with its keyboard LEDs
Why Cities Are a Low-Hanging Fruit For Ransomware
How any Instagram account could be hacked in less than 10 minutes

Several security issues were fixed in Squid.

A system hardening measure could be bypassed.

Apple quietly removes Zoom’s hidden web server from Macs

An update that fixes one vulnerability is now available.

FCC underwhelmed by carriers’ sluggish robocall efforts

Zipios could be made to crash or consume system resources if it received specially crafted input.

This update upgrades Thunderbird to version 60.8.0. * Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709) * Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811) * Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711) * Mozilla: Cross-origin POST requests can be made with NPAPI plugins by […]

Several security issues were fixed in Exiv2.

vim/neovim: ‘:source!’ command allows arbitrary command execution via modelines (CVE-2019-12735) SL6 x86_64 vim-X11-7.4.629-5.el6_10.2.x86_64.rpm vim-common-7.4.629-5.el6_10.2.x86_64.rpm vim-debuginfo-7.4.629-5.el6_10.2.x86_64.rpm vim-enhanced-7.4.629-5.el6_10.2.x86_64.rpm vim-filesystem-7.4.629-5.el6_10.2.x86_64.rpm vim-minimal-7.4.629-5.el6_10.2.x86_64.rpm i386 [More…]

Ransomware attackers, US mayors say you should go jump in a lake
Malicious code ousted from PureScript’s npm installer – but who put it there in the first place?
New old Windows bug emerges, your ‘strong’ password is anything but, plus plenty more

Risk Level: Very Low. Type: Trojan.

Risk Level: Very Low. Type: Trojan.

Risk Level: Very Low. Type: Trojan.

Threatlist: 68% of Overwhelmed IT Managers Can’t Keep Up with Cyberattacks
Exploring the Top 15 Most Common Vulnerabilities with HackerOne and GitHub

Vulnerabilities have been identified in libspring-java, a modular Java/J2EE application framework.

An update that solves one vulnerability and has 11 fixes is now available.

An update that fixes three vulnerabilities is now available.

Firefox could be made to crash or run programs as your login if it opened a malicious website.

An update that solves one vulnerability and has one errata is now available.

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

An update that fixes two vulnerabilities is now available.

In memoriam – Corby Corbató, MIT computer science pioneer, dies at 93

Harsh Jaiswal discovered a remote shell execution vulnerability in ruby-mini-magick, a Ruby library providing a wrapper around ImageMagick or GraphicsMagick, exploitable when using MiniMagick::Image.open with specially crafted URLs coming from unsanitized user input.

security update

An update that contains security fixes can now be installed.

#### Update to v1.48 * New API: – `snapd_client_get_connections_async` – `snapd_client_get_connections_finish` – `snapd_client_get_connections_sync` – `snapd_client_get_interfaces2_async` – `snapd_client_get_interfaces2_finish` – `snapd_client_get_interfaces2_sync` – `snapd_client_get_snap_conf_async`

– New upstream version (60.8.0)

#### Update to v1.48 * New API: – `snapd_client_get_connections_async` – `snapd_client_get_connections_finish` – `snapd_client_get_connections_sync` – `snapd_client_get_interfaces2_async` – `snapd_client_get_interfaces2_finish` – `snapd_client_get_interfaces2_sync` – `snapd_client_get_snap_conf_async`

– Update to 2.8 fixes rhbz#1581180 rhbz#1603993 rhbz#1674893 and rhbz#1524335 – Removed upstreamed patch – Bug 1524335 – CVE-2017-17459 fossil: Command injection via malicious ssh URLs [fedora-all] – Bug 1581180 – Update fossil version to 2.6 (currently is 2.2) – Bug 1603993 – fossil: FTBFS in Fedora rawhide – Bug 1674893 – fossil: FTBFS in […]

update to 2.1.10, security fix for CVE-2019-12781

Agent Smith Android malware has infected 25 million devices so far

security update

security update

Brilliant Boston boffins blow big borehole in Bluetooth’s ballyhooed barricades: MAC addy randomization broken
Heather Mills Gets An Apology and ‘Substantial’ Settlement in Spyware Case
Blah blah Blaha: Slovak infosec firm ESET sues politico who called them ‘outrageous fascists’
London cop illegally used police database to monitor investigation into himself

This update upgrades Firefox to version 60.8.0 ESR. * Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8 (CVE-2019-11709) * Mozilla: Sandbox escape via installation of malicious language pack (CVE-2019-9811) * Mozilla: Script injection within domain through inner window reuse (CVE-2019-11711) * Mozilla: Cross-origin POST requests can be made with NPAPI plugins […]

Multiple vulnerabilities were discovered in the HyperLogLog implementation of Redis, a persistent key-value database, which could result in denial of service or potentially the execution of arbitrary code.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery.

Risk Level: Very Low. Type: Trojan.

Risk Level: Very Low. Type: Trojan.

Unusual Linux Ransomware Targets NAS Servers

Reading Time: ~ 2 min. Magecart Attacks See Spike in Automation The latest attack in the long string of Magecart breaches has apparently affected over 900 e-commerce sites in under 24 hours. This increase over the previous attack, which affected 700 sites, suggests that its authors are working on improving the automation of these information-stealing […]

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has one errata is now available.

Hacked Hair Straighteners Can Threaten Homes
UK Home Secretary doubles down on cops’ deeply flawed facial recognition trials

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1763

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1765

An update that fixes one vulnerability is now available.

IT pros: we’re understaffed, under-resourced and under pressure
Hey, Google, why are your contractors listening to me?
Windows 7 users upset by unwanted Patch Tuesday telemetry
Apple Watch’s Walkie-Talkie app goes radio silent due to vulnerability

An update that solves 11 vulnerabilities and has two fixes is now available.

Train maker’s coder goes loco, choo-choo-chooses to flee to China with top-secret code – allegedly

An update that contains security fixes can now be installed.

Oh, lovely, a bipartisan election hack alert law bill for Mitch McConnell to feed into the shredder

security update

Intel patches SSD firmware and microprocessor diagnostic tool
Google Home Silently Captures Recordings of Domestic Violence and More
Twitter is down – Twitter’s website & app suffering outage (Updated)

This update provides ffmpeg version 4.1.4, which fixes several security vulnerabilities and other bugs which were corrected upstream References: – https://bugs.mageia.org/show_bug.cgi?id=25109

10 ways to keep yourself secure online against cyber attacks

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has one errata is now available.

Two vulnerabilities were discovered in the DOSBox emulator, which could result in the execution of arbitrary code on the host running DOSBox when running a malicious executable in the emulator.

Two security vulnerabilities were discovered in openjpeg2, a JPEG 2000 image library. CVE-2016-9112

The urllib library in Python ships support for a second, not well known URL scheme for accessing local files (“local_file://”). This scheme can be used to circumvent protections that try to block local file access

IBM Closes its $34 Billion Acquisition of Red Hat: A Monumental Moment for Open Source
Apple pushes out silent update to remove sketchy Zoom code from Macs
Apple Issues Silent Update Removing Zoom’s Hidden Server
Unprotected MongoDB leaks 188m users’ data from sensitive search engine

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

Apple Disables Walkie-Talkie App Due to Eavesdropping Flaw

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

Facial recognition surveillance must be banned, says Fight for the Future

An update for the virt:8.0.0 module is now available for Red Hat Enterprise Linux 8 Advanced Virtualization. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1726

Apple says its Walkie-Talkie app could be exploited to spy on iPhones
Implementing Bug Bounty Programs: The Right and Wrong Approaches
Cyberattack lands ship in hot water
Wondering how to whack Zoom’s dodgy hidden web server on your Mac? No worries, Apple’s done it for you
GDPR superpowers lead to whopper ICO fines for BA, Marriott
Why CVSS does not equal risk: How to think about risk in your environment

An update that solves one vulnerability and has one errata is now available.