Menu

Monthly Archives: January 2021

Poor password security at the British branch of Mensa?
GnuPG crypto library can be pwned during decryption – patch now!

New upstream version 10.94.00. Introduced new script pamhomography.

Fixes heap use-after-free when parsing malformed file (upstream issue [2989](https://gitlab.com/mbunkus/mkvtoolnix/-/issues/2989)).

New upstream version 2.0.24 with all reported CVE fixes available.

IRQ vector leak on x86 [XSA-360]

This is probably not the update you want. Let me be clear, it does fix the security vulnerabilities in this list: CVE-2020-16044 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134

An update that fixes 6 vulnerabilities is now available.

An update that contains security fixes can now be installed.

An update that contains security fixes can now be installed.

An update that fixes one vulnerability is now available.

Google QUIC-ly left privacy behind in its quest for a speedier internet, boffins find

An update that solves two vulnerabilities and has one errata is now available.

WordPress Pop-Up Builder Plugin Flaw Plagues 200K Sites
Microsoft 365 Becomes Haven for BEC Innovation

Fixes startup crash.

Update to latest upstream version.

Severe bug in Libgcrypt – used by GPG and others – is a whole heap of trouble, prompts patch scramble
Industrial Gear at Risk from Fuji Code-Execution Bugs
European Commission redacts AstraZeneca vaccine contract – but forgets to wipe the bookmarks tab
Emotet botnet disrupted in global operation

The law enforcement action is one of the most significant operations against cybercriminal enterprises ever The post Emotet botnet disrupted in global operation appeared first on WeLiveSecurity

Data Privacy Day: Top tips for safe remote learning

As schools and students continue to contend with the very real cyber-risks of virtual classrooms, we share some advice for protecting children’s data and privacy The post Data Privacy Day: Top tips for safe remote learning appeared first on WeLiveSecurity

Apple iOS 14 Thwarts iMessage Attacks With BlastDoor System
Hackers could live-stream your home through your LifeShield security camera
The mystery of the missing Perl website
Lazarus Affiliate ‘ZINC’ Blamed for Campaign Against Security Researcher

The package libgcrypt before version 1.9.1-1 is vulnerable to arbitrary code execution.

The package home-assistant before version 2021.1.4-1 is vulnerable to information disclosure.

The package mutt before version 2.0.5-1 is vulnerable to denial of service.

The package libvirt before version 1:7.0.0-1 is vulnerable to arbitrary code execution.

Considering privacy in a work from home world

An update that fixes 26 vulnerabilities is now available.

BEC scammers take advantage of “Out-of-office” Microsoft 365 users

New Firefox version (85.0) with various Wayland fixes. New NSS version (3.60).

security update

security update

Rocke Group’s Malware Now Has Worm Capabilities
Utah Ponders Making Online ‘Catfishing’ a Crime
Cybersecurity tips for university students
LogoKit Simplifies Office 365, SharePoint ‘Login’ Phishing Pages
Mimecast Confirms SolarWinds Hack as List of Security Vendor Victims Snowball
Emotet botnet takedown – what you need to know

An update that fixes one vulnerability is now available.

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

How do most cloud security breaches happen? Orca’s “State of Public Cloud Security” report reveals all
If you want to leg it through China’s Great Firewall, don’t forget to pull on your newly darned Shadowsocks
Smashing Security podcast #212: Dutch leaks, Peeping Toms, and researchers under fire
Apple patches three iOS zero‑days under attack

The company emits emergency updates to fix bugs affecting devices ranging from iPhones to Apple Watches The post Apple patches three iOS zero‑days under attack appeared first on WeLiveSecurity

TeamTNT Cloaks Malware With Open-Source Tool
FTC warns of scam website that promises refund for victims of online scams
NetWalker Ransomware Suspect Charged: Tor Site Seized
Update your iPhone now to protect against vulnerabilities that hackers may have actively exploited

Update to 2.53.6

Update to latest upstream version.

Remote Attackers Can Now Reach Protected Network Devices via NAT Slipstreaming
Knock, knock. Who’s there? NAT. Nat who? A NAT URL-borne killer

security update

North Korean hackers attempt to hack security researchers investigating zero-day vulnerabilities
Stack Overflow 2019 hack was guided by advice from none other than… Stack Overflow
Sudo Bug Gives Root Access to Mass Numbers of Linux Systems
ADT Security Camera Flaws Open Homes to Eavesdropping
Emotet Takedown Disrupts Vast Criminal Infrastructure; NetWalker Site Offline
Command ‘n’ control botnet of notorious Emotet Windows ransomware shut down in multinational police raid
Wormable Android malware spreads via WhatsApp messages

“Download This application and Win Mobile Phone”, reads the message attempting to trick users into downloading a fake Huawei app The post Wormable Android malware spreads via WhatsApp messages appeared first on WeLiveSecurity

Today’s ‘sophisticated cyber attack’ victim is the Woodland Trust: Pre-Xmas breach under investigation
Apple critical patches fix in-the-wild iPhone exploits – update now!

An update that fixes 26 vulnerabilities is now available.

An update for firefox is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

Apple Patches Three Actively Exploited Zero-Days, Part of iOS Emergency Update

An update for firefox is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Multiple vulnerabilities have been found in phpMyAdmin, allowing remote attackers to conduct XSS.

Multiple vulnerabilities have been found in Telegram, the worst of which could result in information disclosure.

US cyber intelligence officer jailed for kidnapping her kid, trying to hawk top secrets to Russia in Mexico
Nvidia Squashes High-Severity Jetson DoS Flaw
DanaBot Malware Roars Back into Relevancy
Decade-old bug in Linux world’s sudo can be abused by any logged-in user to gain root privileges
Apple emits emergency iOS security updates while warning holes may have been exploited in wild by hackers

security update

23M Gamer Records Exposed in VIPGames Leak
Ghost hack – criminals use deceased employee’s account to wreak havoc
Criminal, Domestic Violence Case Info Exposed in Cook County Leak
Nefilim Ransomware Gang Hits Jackpot with Ghost Account
North Korea Targets Security Researchers in Elaborate 0-Day Campaign
I was targeted by North Korean 0-day hackers using a Visual Studio project, vuln hunter tells El Reg

The Qualys Research Labs discovered a heap-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users. Any local user (sudoers and non-sudoers) can exploit this flaw for root privilege escalation.

XStream: remote code execution due to insecure XML deserialization when relying on blocklists (CVE-2020-26217) SL7 noarch xstream-1.3.1-12.el7_9.noarch.rpm xstream-javadoc-1.3.1-12.el7_9.noarch.rpm – Scientific Linux Development Team

TikTok Flaw Lay Bare Phone Numbers, User IDs For Phishing Attacks

An update that fixes 26 vulnerabilities is now available.

UK Cabinet Office spokesman tells House of Lords: We’re not being complacent about impact of SolarWinds hack

An update for cryptsetup is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

An update for gnome-settings-daemon is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

An update for net-snmp is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.

North Korea infected infosec bods with backdoors via dodgy blog pages, Visual Studio files – Google

Skyrocketing Bitcoin prices prompt resurgence in mining malware As the price of the cryptocurrency Bitcoin pushes record highs, there’s been a corresponding resurgence in cryptomining malware. Illicit miners had slipped off the radar as Bitcoin’s value plummeted in recent years, but now authors are hoping to profit off the latest price increase. Researchers have identified […]

Biden said to be assembling cyber dream team to sort out US govt computer security
Breaking Down Joe Biden’s $10B Cybersecurity ‘Down Payment’
Outgoing FCC Chair Issues Final Security Salvo Against China