Menu

Monthly Archives: November 2019

Type: Vulnerability. Cisco Small Business RV Series Routers are prone to a remote command injection vulnerability; fixes are available.

Type: Vulnerability. Cisco Web Security Appliance is prone to a cross-site scripting vulnerability; fixes are available.

Art Imitates Life: Lessons from the Final Season of Mr. Robot

New kernel packages are available for Slackware 14.2 to fix security issues.

Pwn2Own Tokyo Roundup: Amazon Echo, Routers, Smart TVs Fall to Hackers
Morrisons is to blame for 100k payroll theft and leak, say 9,000 workers
News Wrap: Voice Assistant Laser Hack, Twitter Insider Threats, Data Breach Fine Fails

Reading Time: ~ 2 min. BEC Scam Takes Millions from Nikkei America Officials for Nikkei are working to identify the perpetrators of a recent business email compromise (BEC) scam that took roughly $29 million from the company’s American subsidiary. The illicit transfer took place sometime during the end of September and, though they did make […]

Amazon Fixes Ring Video Doorbell Flaw That Leaked Wi-Fi Credentials
IT services pro hacked former client’s email
Leak of 4,000 Facebook documents heaps more trouble on internet giant
Another Facebook hoax: Robbers still throwing eggs at car windows?

An update that fixes one vulnerability is now available.

Applications using FriBidi could be made to crash or run programs as your login if it displayed specially crafted text.

Surveillance kit slinger accused of slapping ‘Made in America’ on Chinese gear, selling it to the US government
What do you get when you allegedly mix Wireshark, a gumshoe child molester, and a court PC? A judge facing hacking charges

security update

Alex Murray discovered a stack-based buffer overflow vulnerability in fribidi, an implementation of the Unicode Bidirectional Algorithm algorithm, which could result in denial of service or potentially the execution of arbitrary code, when processing a large number of unicode

This may shock you but Adobe is shipping insecure software. No, it’s not Flash this time. Nope, not Acrobat, either

security update

Ex-Twitter Employees Spied on Saudi Dissidents: DoJ

It was discovered that Expat did not properly handle internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed (CVE-2019-15903).

Chromium-browser 78.0.3904.87 fixes security issues: Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose

Updated freetds packages fix security vulnerability: Felix Wilhelm discovered that FreeTDS incorrectly handled certain types after a protocol downgrade. A remote attacker could use this issue to cause FreeTDS to crash, resulting in a denial of service, or possibly

Updated python and python3 packages fix security vulnerabilities: It was discovered that Python incorrectly parsed certain email addresses. A remote attacker could possibly use this issue to trick Python applications into accepting email addresses that should be denied (CVE-2019-16056).

Updated unbound packages fix security vulnerability: Versions before 1.9.4 allow accesses to uninitialized memory, which would permit remote attackers to trigger a crash (CVE-2019-16866).

The updated packages fix security issues: Use-after-free when creating index updates in IndexedDB. (CVE-2019-11757)

The updated packages fix several bugs and some security issues: Use-after-free when creating index updates in IndexedDB. (CVE-2019-11757)

Updated proftpd package fixes security vulnerabilities: It was discovered that the mod_copy module of ProFTPD, a FTP/SFTP/FTPS server, performed incomplete permission validation for the CPFR/CPTO commands (CVE-2019-12815).

Communication, communication – and politics: Iowa saga of cuffed infosec pros reveals pentest pitfalls

Type: Vulnerability. Cisco Wireless LAN Controller is prone to a remote denial-of-service vulnerability; fixes are available.

Type: Vulnerability. Cisco Web Security Appliance is prone to an unauthorized-access vulnerability; fixes are available

Type: Vulnerability. Multiple Cisco Products are prone to an remote code-execution vulnerability; fixes are available.

Type: Vulnerability. Cisco TelePresence Advanced Media Gateway is prone to a remote denial-of-service vulnerability.

Type: Vulnerability. Cisco Industrial Network Director is prone to a cross-site scripting vulnerability; fixes are available.

Type: Vulnerability. libarchive is prone to an arbitrary code-execution vulnerability; fixes are available.

Type: Vulnerability. Google Android is prone to multiple local privilege-escalation vulnerabilities.

Type: Vulnerability. Google Android is prone to multiple security vulnerabilities; fixes are available.

Type: Vulnerability. Google Android is prone to multiple local privilege-escalation vulnerabilities; fixes are available.

Type: Vulnerability. Joomla! Core is prone to an information-disclosure vulnerability; fixes are available.

Amazon Kindle, Embedded Devices Open to Code-Execution
Gamers Hit with Nvidia GPU Driver, GeForce Flaws
How to Secure Critical Infrastructure When Patching Isn’t Possible
Facebook scam steals famous faces and BBC branding
WordPress sites hit by malvertising
Morrisons tells top court it’s not liable for staffer who nicked payroll data of 100,000 employees

The package linux-hardened before version 5.3.7.b-1 is vulnerable to arbitrary code execution.

Data Breach Fines: Are They Working to Boost Consumer Safety?
Linux users warned to update libarchive to beat flaw
Pilot presses the wrong button, triggers airport hostage alarm
Google Enlists Help to Fight Bad Android Apps
Facebook confesses 100 devs may have accessed leaked Groups data
Warrant let police search online DNA database

An update for cri-o is now available for Red Hat OpenShift Container Platform 3.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

An update for mediawiki123 is now available for Red Hat OpenShift Container Platform 3.9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which

An update for atomic-openshift is now available for Red Hat OpenShift Container Platform 3.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Mac users warned that disabling all Office macros doesn’t actually disable all Office macros

Several security issues were fixed in WebKitGTK+.

An update that fixes 9 vulnerabilities is now available.

An update that solves one vulnerability and has two fixes is now available.

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has two fixes is now available.

An update that solves one vulnerability and has two fixes is now available.

An update for openstack-octavia is now available for Red Hat OpenStack Platform 13.0 (Queens). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 13.0 (Queens). Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

We’re almost into the third decade of the 21st century and we’re still grading security bugs out of 10 like kids. Why?
Microsoft crams Office 365 docs into Edge-style sandboxes to thwart malware infections
Ex-Twitter staff charged with spying for Saudi royals: Duo accused of leaking account records, including those of critics
Smashing Security #153: Cybercrime doesn’t pay (but Uber does)
Google’s joins Gang of Four to guard Play Store apps from malware, and maybe not fail so much
Microsegmentation and Isolation: 2 Essential Strategies in Zero-Trust Security
You’ve Been Served…with Subpoena-Themed Phishing Emails
NSA to Congress: Our spy programs don’t work, aren’t used, or have gone wrong – now can you permanently reauthorize them?
Rogue Trend Micro Employee Sold Customer Data for 68K Accounts

security update

Trend Micro: Our super-duper security software will keep you safe from everyone – except our staff who go rogue

Type: Vulnerability. Joomla! is prone to a cross-site request-forgery vulnerability; fixes are available.

Type: Vulnerability. Google Android is prone to a privilege-escalation vulnerability; fixes are available.

Type: Vulnerability. Google Android is prone to multiple information-disclosure vulnerabilities; fixes are available.

Type: Vulnerability. MantisBT is prone to an HTML-injection vulnerability; fixes are available.

Type: Vulnerability. Google Android is prone to a remote code execution vulnerability; fixes are available.

Type: Vulnerability. Red Hat ‘389-ds-base’ is prone to a security-bypass vulnerability; fixes are available.

Type: Vulnerability. Xen is prone to a privilege-escalation vulnerability; fixes are available.

Type: Vulnerability. Linux Kernel is prone to a denial-of-service vulnerability; fixes are available.

Type: Vulnerability. Sonatype Nexus Repository Manager is prone to an OS command-injection vulnerability; fixes are available.

Facebook Privacy Breach: 100 Developers Improperly Accessed Data
DarkUniverse APT Emerges to Deliver Sophisticated, Targeted Spy Attacks
Controversies aren’t Boeing away for aircraft maker amid claims of faulty oxygen systems and wobbling wings
Emotet Resurgence Continues With New Tactics, Techniques and Procedures
Leeds IT bloke pleads guilty to hacking Jet2 CEO’s email account
Google Analytics Emerges as a Phishing Tool
Presentation Template: Build Your 2020 Security Plan
Smartphone and speaker voice assistants can be hacked using lasers
Mozilla says ISPs are lying to Congress about encrypted DNS
Ransomware attacks in Spain leave radio station in “hysteria”
Founders of ‘worthless cryptocurrency’ ATM Coin fined over $4.25m scam
Before you high-five yourselves for setting up that bug bounty, you’ve got the staff in place to actually deal with security, right?

security update

Type: Vulnerability. Multiple F5 BIG-IP Products are prone to a cross-site scripting vulnerability.

Google patches bug that let nearby hackers send malware to your phone