Menu

Monthly Archives: August 2021

Apple is about to start scanning iPhone users’ devices for banned content, warns professor
Auditors: Feds’ Cybersecurity Gets the Dunce Cap

security update

“Cobalt Strike” network attack tool patches crashtastic server bug
Black Hat 2021 – non‑virtual edition

How is Black Hat USA 2021 different from the past editions of the conference and what kinds of themes may steal the show this year? The post Black Hat 2021 – non‑virtual edition appeared first on WeLiveSecurity

MacOS Flaw in Telegram Retrieves Deleted Messages
Black Hat: Microsoft’s Patch for Windows Hello Bypass Bug is Faulty, Researchers Say
Black Hat: Charming Kitten Leaves More Paw Prints
Got a cheap Cisco router in your home office? If it’s one of these, there’s an exposed RCE hole you need to plug

An update that fixes four vulnerabilities is now available.

This update provides a new upstream version.

An update that fixes one vulnerability is now available.

An update that solves four vulnerabilities and has one errata is now available.

An update that fixes 6 vulnerabilities is now available.

An update that solves four vulnerabilities and has two fixes is now available.

Das tut mir leid! Germany’s ruling party sorry for calling cops on researcher after she outed canvassing app flaws
Security tips from the experts – sign up to 1Password’s free Security Summer School today
Not all authentication is created equal – and that’s a good thing
‘I’m Calling About Your Car Warranty’, aka PII Hijinx
Black Hat: Security Bugs Allow Takeover of Capsule Hotel Rooms
Black Hat: Let’s All Help Cyber-Immunize Each Other
Worried your data protection strategy is dated? Don’t let a ransomware infection prove you right
SolarWinds urges US judge to toss out crap infosec sueball: We got pwned by actual Russia, give us a break
Phishing Campaign Dangles SharePoint File-Shares

openCryptoki could be made to allow invalid curve attacks if it received a specially crafted key.

Google: Linux kernel and its toolchains are underinvested by at least 100 engineers
Best File & Disk Encryption Tools for Linux>

PEAR could be made to overwrite files as the administrator.

Several security issues were fixed in Perl DBI module.

UK data watchdog sees its approach to government health tech during COVID-19 outbreak as ‘pragmatic’
Legacy EDR. Yes, it’s a thing
We COVID-Clicked on Garbage, Report Finds: Podcast

An update that fixes four vulnerabilities is now available.

Security fix for CVE-2021-34558

Security fix for CVE-2021-34558

Iranian APT Lures Defense Contractor in Catfishing-Malware Scam
Russia tells UN it wants vast expansion of cybercrime offenses, plus network backdoors, online censorship
Ransomware Volumes Hit Record Highs as 2021 Wears On
Do you have a grip on the lifecycle security of your AWS-deployed applications?
On course for a good hacking

A story of how easily hackers could hit a hole-in-one with the computer network of a premier golf club in the UK. The post On course for a good hacking appeared first on WeLiveSecurity

Raccoon Stealer Bundles Malware, Propagates Via Google SEO
BazarCaller – the malware gang that talks you into infecting yourself
‘DeadRinger’ Targeted Exchange Servers Long Before Discovery
UK’s Ministry of Defence coughs up bug bounties for crowdsourced pentesting

The package chromium before version 92.0.4515.131-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing.

The package nodejs-lts-erbium before version 12.22.4-1 is vulnerable to arbitrary code execution.

The package nodejs-lts-fermium before version 14.17.4-1 is vulnerable to arbitrary code execution.

The package nodejs before version 16.6.0-1 is vulnerable to arbitrary code execution.

Shopping for execs: ID management biz Okta poaches Google’s veep of engineering to run product dev activities

lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – lasso-2.5.1-8.el7_9.i686.rpm – lasso-2.5.1-8.el7_9.x86_64.rpm – lasso-debuginfo-2.5.1-8.el7_9.i686.rpm – lasso-debuginfo-2.5.1-8.el7_9 [More…]

An update for glibc is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

Research finds cyber-snoops working for ‘Chinese state interests’ lurking in SE Asian telco networks since 2017
‘PwnedPiper’: Devastating Bugs in >80% of Hospital Pneumatics

security update

Chipotle Emails Serve Up Phishing Lures
Credit-card-stealing, backdoored packages found in Python’s PyPI library hub
Nuisance call-blocking firm fined £170,000 for making almost 200,000 nuisance calls

An update for lasso is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

PwnedPiper vulns have potential to turn Swisslog’s PTS hospital products into Swiss cheese, says Armis
CrowdSec v1.1.x Is Out! Here’s What’s New & How To Get Started >

An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Extended Update Support, and Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact

Several security issues were fixed in QPDF.

Huawei to America: You’re not taking cyber-security seriously until you let China vouch for us
Zoom agrees to pay subscribers $25 to put its security SNAFUs behind it

The container sles-15-sp3-chost-byos-v20210729 was updated. The following patches have been included in this update:

The container suse-sles-15-sp3-chost-byos-v20210729-gen2 was updated. The following patches have been included in this update:

The 5.13.6 stable kernel update contains a number of important fixes across the tree.

The container suse-sles-15-sp3-chost-byos-v20210729-hvm-ssd-x86_64 was updated. The following patches have been included in this update:

# New in release OpenJDK 11.0.12 (2021-07-20): Live versions of these release notes can be found at: * https://bitly.com/openjdk11012 * https://builds.shipilev.net/backports-monitor/release-notes-11.0.12.txt ## Security fixes – JDK-8256157: Improve bytecode assembly – JDK-8256491: Better HTTP transport – JDK-8258432, CVE-2021-2341: Improve file transfers –

# New in release OpenJDK 8u302 (2021-07-20) Live versions of these release notes can be found at: * https://bitly.com/openjdk8u302 * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt ## Security fixes * JDK-8256157: Improve bytecode assembly * JDK-8256491: Better HTTP transport * JDK-8258432, CVE-2021-2341: Improve file transfers *

Upstream 6.2.5 release (RHBZ #1984631). Fix CVE-2021-32761: 32-bit systems BITFIELD command integer overflow.

# New in release OpenJDK 8u302 (2021-07-20) Live versions of these release notes can be found at: * https://bitly.com/openjdk8u302 * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt ## Security fixes * JDK-8256157: Improve bytecode assembly * JDK-8256491: Better HTTP transport * JDK-8258432, CVE-2021-2341: Improve file transfers *

# New in release OpenJDK 11.0.12 (2021-07-20): Live versions of these release notes can be found at: * https://bitly.com/openjdk11012 * https://builds.shipilev.net/backports-monitor/release-notes-11.0.12.txt ## Security fixes – JDK-8256157: Improve bytecode assembly – JDK-8256491: Better HTTP transport – JDK-8258432, CVE-2021-2341: Improve file transfers –