Fedora 32 : python39 (2020-97d775e649)

Python 3.9.0b5 update. Contains security fix for CVE-2019-20907. Full changelog. Large autogenerated modules pydocdata and several encodings are now present as pyc optimization 0 files only. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Root Cause Analyses for 0-day In-the-Wild Exploits

Posted by Maddie Stone, Project Zero When a 0-day is exploited in the wild AND it is detected, we need to use that as an opportunity to learn as much as possible about the vulnerability and the exploit if we hope to make 0-day hard. One of the main methods to do that is to perform a root cause...

Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019

Posted by Maddie Stone, Project Zero In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post...

Debian: Security Advisory (DLA-2291-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2286-1] tomcat8 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2286-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 22, 2020 https://wiki.debian.org/LTS -...

How to unc0ver a 0-day in 4 hours or less

By Brandon Azad, Project Zero At 3 PM PDT on May 23, 2020, the unc0ver jailbreak was released for iOS 13.5 the latest signed version at the time of release using a zero-day vulnerability and heavy obfuscation. By 7 PM, I had identified the vulnerability and informed Apple. By 1 AM, I had sent App...

Debian DSA-4703-1 : mysql-connector-java - security update

Three vulnerabilities have been found in the MySQL Connector/J JDBC driver. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4703. The text itself is copyright C Software in the Public Interest, Inc...

CVE-2020-13143

gadgetdevdescUDCstore in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal '\0' value, which allows attackers to trigger an out-of-bounds read, aka CID-15753588bcd4...

Debian: Security Advisory (DLA-2235-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Integer overflow

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature...

Windowsrcer IE/Edge Cross-URL vulnerabilities

Cross-Origin bugs in IE and Edge allow bypassing SOP in both browsers. 0-days released by James Lee @Windowsrcer Recent assessments: busterb at August 21, 2019 4:31pm UTC reported: A SOP bug requires the attacker to inject a resource into one domain, and be listening on another. Such a...

CVE-2020-13757

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior such as by...

New Tool Can Jailbreak Any iPhone and iPad Using An Unpatched 0-Day Bug

The hacking team behind the "unc0ver" jailbreaking tool has released a new version of the software that can unlock every single iPhone, including those running the latest iOS 13.5 version. Calling it the first zero-day jailbreak to be released since iOS 8, unc0ver's lead developer Pwn20wnd said...

CVE-2019-7246

An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr instruction and does not properly filter the Model Specific Register MSR. Allowing arbitrary MSR writes can lead to Ring-0 code execution an...

CVE-2019-7247

An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register MSR. Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges...

Privilege escalation

An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL 0x81112ee0 and does not properly filter the Model Specific Register MSR. Allowing arbitrary MSR writes can lead to Ring-0 code execution and escalation of privileges...

CVE-2019-7246

An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. The vulnerable driver exposes a wrmsr instruction and does not properly filter the Model Specific Register MSR. Allowing arbitrary MSR writes can lead to Ring-0 code execution an...

CVE-2019-7246

The CVE-2019-7246 entry concerns the AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility driver atillk64.sys (version 5.11.9.0). The vulnerability arises from improper filtering of Model Specific Registers (MSR) and exposure of a wrmsr instruction, allowing arbitrary MSR writes that...

CVE-2019-7247

CVE-2019-7247 affects AMD OverDrive’s AODDriver2.sys. The driver exposes wrmsr via IOCTL 0x81112ee0 and fails to properly filter MSRs, enabling arbitrary MSR writes that can lead to Ring-0 code execution and privilege escalation. Documents from Red Hat and other sources corroborate the same flaw....

S. Siedle & Soehne SG 150-0 Smart Gateway Competitive Conditions Issue Vulnerability

S.Siedle & Soehne SG 150-0 Smart Gateway is a home smart gateway product from S.Siedle & Soehne, Germany. A security vulnerability exists in the S.Siedle & Soehne SG 150-0 Smart Gateway versions prior to 1.2.4. The vulnerability can be exploited by an attacker to gain root access to the gateway...