March 19, 2023
Update to 102.9.0 ; https://www.mozilla.org/en- US/security/advisories/mfsa2023-11/ ; https://www.thunderbird.net/en- US/thunderbird/102.9.0/releasenotes/
March 19, 2023
Denial of service using crafted input. (CVE-2022-40152) References: – https://bugs.mageia.org/show_bug.cgi?id=31665 – https://lists.suse.com/pipermail/sle-security-updates/2023-March/013995.html
March 18, 2023
Remote code execution on feed enrichment. If “Extract full content from HTML5 and Google AMP” has been enabled for one or more feed subscriptions it is possible for a an attacker to inject a script command that runs with user priveleges. (CVE-2023-1350)
March 18, 2023
An out-of-bounds write vulnerability exists in TPM2.0’s Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in
March 18, 2023
A potential buffer overflow exists in the file src/w_help.c at line 55. Specifically, the length of the string returned by getenv(“LANG”) may become very long and cause a buffer overflow while executing the sprintf() function. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
March 18, 2023
Some mod_proxy configurations on Apache HTTP Server allow a HTTP request smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied
March 18, 2023
Banking turmoil opens opportunities for fraud – Week in security with Tony Anscombe
Scammers are looking to cash in on the chaos that has set in following the startling meltdowns of Silicon Valley Bank and Signature Bank and the crisis at Credit Suisse The post Banking turmoil opens opportunities for fraud – Week in security with Tony Anscombe appeared first on WeLiveSecurity
March 18, 2023
The container suse/sle-micro/5.2/toolbox was updated. The following patches have been included in this update:
March 18, 2023
The container suse/sle-micro/5.1/toolbox was updated. The following patches have been included in this update:
March 18, 2023
update to 111.0.5563.64. Fixes the following security issues: CVE-2023-0927 CVE-2023-0928 CVE-2023-0929 CVE-2023-0930 CVE-2023-0931 CVE-2023-0932 CVE-2023-0933 CVE-2023-0941 CVE-2023-1213 CVE-2023-1214 CVE-2023-1215 CVE-2023-1216 CVE-2023-1217 CVE-2023-1218 CVE-2023-1219 CVE-2023-1220 CVE-2023-1221 CVE-2023-1222 CVE-2023-1223 CVE-2023-1224 CVE-2023-1225
March 18, 2023
CVE-2022-37454: Fix buffer overflows in _sha3 module
March 18, 2023
Update to OWSLib-0.28.1, fixes CVE-2023-27476.
March 18, 2023
Security fix for CVE-2022-41717
March 18, 2023
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
March 17, 2023
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:
March 17, 2023
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or spoofing.
March 17, 2023
SVB collapse is a scammer’s dream: Don’t get caught out
How cybercriminals can exploit Silicon Valley Bank’s downfall for their own ends and at your expense The post SVB collapse is a scammer’s dream: Don’t get caught out appeared first on WeLiveSecurity
March 17, 2023
One of the security fixes released as DSA 5356 introduced a regression in the processing of specific WAV files. Updated sox packages are available to correct this issue.
March 17, 2023
Multiple security issues were discovered in Thunderbird, which could result in denial of service, the execution of arbitrary code or spoofing.
March 17, 2023
The container bci/python was updated. The following patches have been included in this update:
March 17, 2023
security update
March 17, 2023
FTX inner circle helped itself to $3.2B, liquidators say
March 16, 2023
security update
March 16, 2023
security update
March 16, 2023
Got Conti? Here’s the ransomware cure to avoid paying up
March 16, 2023
Not‑so‑private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets
ESET researchers analyzed Android and Windows clippers that can tamper with instant messages and use OCR to steal cryptocurrency funds The post Not‑so‑private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets appeared first on WeLiveSecurity
March 16, 2023
The container suse/sles/15.5/virt-operator was updated. The following patches have been included in this update:
March 16, 2023
The container suse/sles/15.5/libguestfs-tools was updated. The following patches have been included in this update:
March 16, 2023
The container suse/sles/15.5/virt-launcher was updated. The following patches have been included in this update:
March 16, 2023
The container suse/sles/15.5/virt-handler was updated. The following patches have been included in this update:
March 16, 2023
The container suse/sles/15.5/virt-exportserver was updated. The following patches have been included in this update:
March 16, 2023
The container suse/sles/15.5/virt-exportproxy was updated. The following patches have been included in this update:
March 16, 2023
Several buffer overflows were found which allow an attacker to make tcpdump crash.
March 15, 2023
Sebastian Krahmer found a problem in the modprobe utility that could beexploited by local users to run arbitrary commands as root if themachine is running a kernel with kmod enabled.
March 15, 2023
Proton reported on bugtraq that tcsh did not handle in-here documentscorrectly. The version of tcsh that is distributed with Debian GNU/Linux2.2r0 also suffered from this problem.
March 15, 2023
The version of gnupg that was distributed in Debian GNU/Linux 2.2 hada logic error in the code that checks for valid signatures which couldcause false positive results:
March 15, 2023
The slow Tick‑ing time bomb: Tick APT group compromise of a DLP software developer in East Asia
ESET Research uncovered a campaign by APT group Tick against a data-loss prevention company in East Asia and found a previously unreported tool used by the group The post The slow Tick‑ing time bomb: Tick APT group compromise of a DLP software developer in East Asia appeared first on WeLiveSecurity
March 15, 2023
Emacs could be made to crash or run programs as your login if it opened a specially crafted file.
March 15, 2023
Several security issues were fixed in OpenJPEG.
March 15, 2023
Tailscale: Fast and easy VPNs for developers
March 15, 2023
No matter how old you are, it is important to learn how to stay safe online! According to a study conducted by Learning Innovation, more than 93% of students have access to smartphones and laptops. Cyber threats show no sign of slowing down, which is why it is important to stay up to date on […]
March 15, 2023
Microsoft fixes two 0-days on Patch Tuesday – update now!
March 15, 2023
security update
March 14, 2023
Firefox 111 patches 11 holes, but not 1 zero-day among them…
March 14, 2023
5 signs you’ve fallen for a scam – and what to do next
Here’s how to know you have fallen victim to a scam – and what to do in order to undo or mitigate the damage. The post 5 signs you’ve fallen for a scam – and what to do next appeared first on WeLiveSecurity
March 14, 2023
How OpenSSF Aims to Make Log4j-Like Incidents Rare
March 14, 2023
The container sles-15-sp4-chost-byos-v20230310-arm64 was updated. The following patches have been included in this update:
March 14, 2023
The container suse-sles-15-sp4-chost-byos-v20230310-hvm-ssd-x86_64 was updated. The following patches have been included in this update:
March 14, 2023
The container suse-sles-15-sp4-chost-byos-v20230310-x86_64-gen2 was updated. The following patches have been included in this update:
March 14, 2023
It was discovered that there was a potential remote denial of service vulnerability in redis, a popular key-value database. Authenticated users could have used string matching commands (like
March 14, 2023
Security fix for CVE-2023-25193 Update of HarfBuzz to 7.0.1 version (#2169172) Update of freetype to 2.13.0 version (#2168496) —- Security fix for CVE-2023-25193, Update to 7.0.1 version (#2169172)
March 14, 2023
Security fix for CVE-2023-25193 Update of HarfBuzz to 7.0.1 version (#2169172) Update of freetype to 2.13.0 version (#2168496) —- Security fix for CVE-2023-25193, Update to 7.0.1 version (#2169172)
March 14, 2023
GitHub begins 2FA rollout
March 13, 2023
Linux gets double-quick double-update to fix kernel Oops!
March 13, 2023
Several security issues were fixed in XStream.
March 13, 2023
The container ses/7.1/rook/ceph was updated. The following patches have been included in this update:
March 13, 2023
The container ses/7.1/ceph/ceph was updated. The following patches have been included in this update:
March 13, 2023
The container ses/7.1/cephcsi/cephcsi was updated. The following patches have been included in this update:
March 13, 2023
Several security issues were fixed in Twig.
March 13, 2023
The UK’s bad encryption law can’t withstand global contempt
March 13, 2023
Several security issues were fixed in Protocol Buffers.
March 13, 2023
Cutting complexity
March 13, 2023
update to 111.0.5563.64. Fixes the following security issues: CVE-2023-0927 CVE-2023-0928 CVE-2023-0929 CVE-2023-0930 CVE-2023-0931 CVE-2023-0932 CVE-2023-0933 CVE-2023-0941 CVE-2023-1213 CVE-2023-1214 CVE-2023-1215 CVE-2023-1216 CVE-2023-1217 CVE-2023-1218 CVE-2023-1219 CVE-2023-1220 CVE-2023-1221 CVE-2023-1222 CVE-2023-1223 CVE-2023-1224 CVE-2023-1225
March 12, 2023
An issue has been found in mpv, a video player based on MPlayer/mplayer2. Due to a use after free an attacker coudl execute arbitrary code or crash the program via the ao_c parameter.
March 11, 2023
Several vulnerabilities have been discovered in imagemagick that may lead to a privilege escalation, denial of service or information leaks. CVE-2020-19667
March 11, 2023
High CVE-2023-1213: Use after free in Swiftshader. Reported by Jaehun Jeong(@n3sk) of Theori on 2023-01-30 High CVE-2023-1214: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-02-03
March 11, 2023
A change in the libreswan 4.2 Traffic Selector parsing code introduced a missing check that would reject palformed Traffic Selector payloads. As such, in such case the code stumbles on to hit a double free, leading to a crash and restart of the pluto daemon. No remote code execution. (CVE-2023-23009)
March 11, 2023
This kernel-linus update is based on upstream 5.15.98 and fixes atleast the following security issues: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1
March 11, 2023
APT hackers set a honeytrap to ensnare victims – Week in security with Tony Anscombe
A request to move an online conversation to a supposedly more secure platform may not be as well-meaning as it sounds The post APT hackers set a honeytrap to ensnare victims – Week in security with Tony Anscombe appeared first on WeLiveSecurity
March 11, 2023
Common WhatsApp scams and how to avoid them
Here’s a roundup of some of the most common tricks that fraudsters use to dupe their victims on WhatsApp – and what you can do to protect yourself against them. The post Common WhatsApp scams and how to avoid them appeared first on WeLiveSecurity
March 11, 2023