Menu

Latest articles

Microsoft fixes critical bugs in CryptoAPI, RD Gateway and .NET

Applications using libpcap could be made to crash if given specially crafted data.

Malicious npm package taken down after Microsoft warning
Peekaboo Moments baby-recording app has a bad database booboo
Oski Data-Stealing Malware Emerges to Target North America, China
Apple says no to unlocking shooter’s phone; AG and Trump lash back

An update that fixes three vulnerabilities is now available.

An update that fixes 7 vulnerabilities is now available.

Upstream details at : https://access.redhat.com/errata/RHSA-2020:0085

Several security issues were fixed in PHP.

Today’s webcast: Hackers don’t care if you’re big or small. Tune in to find out how to protect your mid-sized biz
Updated your WordPress plugins lately? Here are 320,000 auth-bypassing reasons why you should
Critical Windows 10 security fix pushed out after NSA warns Microsoft of spying vulnerability
Oracle Ties Previous All-Time Patch High with January Updates
Microsoft patches severe Windows flaw after tip‑off from NSA

The US intelligence agency expects attackers to waste no time in developing tools aimed at exploiting the vulnerability The post Microsoft patches severe Windows flaw after tip‑off from NSA appeared first on WeLiveSecurity

Serious Microsoft crypto vulnerability – patch right now
Microsoft’s new tool detects & reports pedophiles from online chats
Welcome to the 2020s: Booby-trapped Office files, NSA tipping off Windows cert-spoofing bugs, RDP flaws…
Intel Fixes High-Severity Flaw in Performance Analysis Tool
Card Skimmer Hits Australian Bushfire Donation Site
Microsoft Patches Major Crypto Spoofing Bug

security update

Apple calls BS on FBI, AG: We’re totally not dragging our feet in murder probe iPhone decryption. PS: No backdoors
Google to Nix Chrome Support for Third-Party Cookies by 2022
LastPass releases its 3rd Annual Global Password Security report
Public Bug Bounty Takes Aim at Kubernetes Container Project
US hands UK ‘dossier’ on Huawei: Really! Still using their kit? That’s just… one… step… beyond
Millions of modems at risk of remote hijacking

Multiple cable modem models from various manufacturers found vulnerable to takeover attacks The post Millions of modems at risk of remote hijacking appeared first on WeLiveSecurity

Windows 7 computers will no longer be patched after today
Fleeceware is back in Google Play – massive fees for not much at all
Adobe Patches Five Critical Illustrator CC Flaws
Boing Boing bounces back after hack attempted to infect users with fake Adobe Flash update
5 cyber tools your business needs in 2020 to keep safe

An update that fixes four vulnerabilities is now available.

An update that fixes one vulnerability is now available.

Apple Denies FBI Request to Unlock Shooter’s iPhone—Again

Upstream details at : https://access.redhat.com/errata/RHSA-2020:0086

27% of Windows users are still running Windows 7. They need to stop now
‘Cable Haunt’ vulnerability exposes 200 million cable modem users
Google tests biometric authentication for Android autofill
Lottery hacker gets 9 months for his £5 cut of the loot

An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.

Microsoft now reviewing Skype audio in ‘secure’ places (not China)
Windows 7 end of life: Time to move on

Today, Microsoft is officially pulling the plug on its support for Windows 7. What’s your plan? The post Windows 7 end of life: Time to move on appeared first on WeLiveSecurity

Several security issues were fixed in SDL_image.

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in gThumb and Pix

Relying on AT&T, Verizon and T-Mob US to protect you from SIM swapping? You better get used to disappointment
Scammers Dupe Texas School District Out of $2.3M
Joker Android Malware Snowballs on Google Play
Someone needs to go back to school: Texas district fleeced for $2.3m after staff fall for devious phishing email
CES Surveillance Hype Worries Privacy Advocates
Privacy activists beg Google to ban un-removable bloatware from Android
New Android malware on Play Store disables Play Protect to evade detection
5 major US wireless carriers vulnerable to SIM swapping attacks

When it comes to protection against this insidious type of scam, the telcos’ authentication procedures leave a lot be desired, a study finds The post 5 major US wireless carriers vulnerable to SIM swapping attacks appeared first on WeLiveSecurity

‘Cable Haunt’ Bug Plagues Millions of Home Modems
Unpatched Citrix Flaw Now Has PoC Exploits
Travelex wants you to know that everything’s going really really well
Man who hacked National Lottery for just £5 is jailed for nine months
Cable Haunt: Hundreds of millions of cable modems may be vulnerable to hijacking attack
Whirlybird-driving infosec boss fined after ranty Blackpool Airport air traffic control antics
Snake alert! This ransomware is not a game…
Powerful GPG collision attack spells the end for SHA-1

An update that solves one vulnerability and has 10 fixes is now available.

An update that fixes one vulnerability is now available.

Updated makepasswd fix insecure default length of password By default, makepasswd generates password with a length between 6 to 8 characters (48 to 64bits). This update raise the default to 16 characters (128 bits).

GraphicsMagick has been updated to fix security issues. References: – https://bugs.mageia.org/show_bug.cgi?id=26056 – http://www.graphicsmagick.org/NEWS.html#december-24-2019

This update is based on upstream 5.4.10 and fixes atleast the following security issues: ext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE)

Updated unbound package to version 1.9.6 to fix various potential security vulnerabilities. References: – https://bugs.mageia.org/show_bug.cgi?id=25974

Shitrix: Hackers target unpatched Citrix systems over weekend
Personal data of millions of Americans exposed from PC in China
Reddit bans ‘impersonation,’ but satire and parody are still OK
Google urged to tame privacy-killing Android bloatware
Lawmakers look to spread COPPA out to cover kids up to 16
UK data watchdog kicks £280m British Airways and Marriott GDPR fines into legal long grass
If you haven’t shored up that Citrix hole, you were probably hacked over the weekend: Exploit code now available

An update that fixes four vulnerabilities is now available.

Fixes bugzilla 1126076

Update to v1.15.7 (CVE-2018-1002102 kubernetes: improper validation of URL redirection in the Kubernetes API server allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints)

New bugfix and security upstream release, see http://www.graphicsmagick.org/NEWS.html#december-24-2019

1.5.7, fix for CVE-2019-13107

Release of 19.05.5. Closes security issues CVE-2019-19727, CVE-2019-19728.

Google hackers successfully use remote exploit to hack iPhone

An update that fixes one vulnerability is now available.

An update that fixes four vulnerabilities is now available.

Hundreds of millions of Broadcom-based cable modems at risk of remote hijacking, eggheads fear

security update

Getting a VPN in Japan

New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues.

Cisco Webex Bug Allows Remote Code Execution
Lifeline Assistance Phone Users Targeted with ‘Uninstallable’ Adware
Graham Cluley on the Totally Unprepared Politics podcast
Is the Y2K bug alive after all?
Amazon Ring fired staff for snooping on customers’ security videos
Hackers using Drake’s kiki do you love me to drop Lokibot malware
National Lottery Sentry MBA hacker given nine months in jail after swiping just £5

An update that fixes 7 vulnerabilities is now available.

An update that solves one vulnerability and has three fixes is now available.

Reading Time: ~ 2 min. Snake Ransomware Slithers Through Networks A new ransomware variant, dubbed “Snake,” has been found using more sophisticated obfuscation while targeting entire networks, rather than only one machine. In addition, Snake will append any encrypted file extensions with five random characters following the filetype itself. Finally, the infection also modifies a […]

Oil-and-Gas APT Pivots to U.S. Power Plants
Just one month later, the Currys PC World/Dixons Travel hack would have cost them a heck of a lot more