Fedora: Security Advisory for docker-distribution (FEDORA-2022-3e1ade35db)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[Security Nation] Jacques Chester of Shopify Talks CVSS Scores

!\Security Nation\ Jacques Chester of Shopify Talks CVSS Scoreshttps://blog.rapid7.com/content/images/2022/07/securitynationlogo-1.jpg In this episode of Security Nation, Shopify Senior Staff Software Developer Jacques Chester joins Jen and Tod to discuss his intriguing paper on CVSS scores and t...

[SECURITY] Fedora 35 Update: stargz-snapshotter-0.10.2-4.fc35

Fast container image distribution plugin with lazy pulling...

[SECURITY] Fedora 35 Update: xe-guest-utilities-latest-7.30.0-4.fc35

Scripts for monitoring XAPI project virtual machine. Writes distribution version information and IP address to XenStore. This package follows the latest version of xe-guest-utilities upstream...

distribution:fuzz_set: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5788681343991808 Project: distribution Fuzzing Engine: libFuzzer Fuzz Target: fuzzset Job Type: libfuzzerasandistribution Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...

Several New Play Store Apps Spotted Distributing Joker, Facestealer and Coper Malware — The Hacker News

Google has taken steps to ax dozens of fraudulent apps from the official Play Store that were spotted propagating Joker, Facestealer, and Coper malware families through the virtual marketplace. While the Android storefront is considered to be a trusted source for discovering and installing apps,...

[SECURITY] Fedora 35 Update: golang-github-containerd-stargz-snapshotter-0.10.1-3.fc35

Fast container image distribution plugin with lazy pulling...

[SECURITY] Fedora 35 Update: glide-0.13.2-10.fc35

Glide is a tool for managing the vendor directory within a Go package. This feature, first introduced in Go 1.5, allows each package to have a vendor directory containing dependent packages for the project. These vendor packages can be installed by a tool e.g. glide, similar to go get or they can...

Fee-on-transfer tokens not supported

Lines of code Vulnerability details Impact Incorrect accounting will lead to wrong assets distribution and some users gaining more and some users getting fewer tokens than they should. Proof of Concept Functions rely on user input to calculate distribution of tokens instead of relying on the...

Fedora: Security Advisory for docker-distribution (FEDORA-2022-ba365d3703)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Microsoft recognized as a Leader in UEM Software 2022 IDC MarketScape reports

Competition for talent has increased pressure to lead in the digital space, and business decisions now weigh user experience for employees heavily among costs and benefits. Workers insist on experiences that mirror their personal experiences, often on their own devices. As enterprise computing ha...

[SECURITY] Fedora 36 Update: docker-distribution-2.6.2-17.git48294d9.fc36

Docker toolset to pack, ship, store, and deliver content...

Data Distribution Service: Mitigating Risks Part 3

In the final chapter of our blog series, we discuss mitigating strategies and recommendations to keep DDS protected from malicious actors...

Hackers Exploiting Follina Bug to Deploy Rozena Backdoor

A newly observed phishing campaign is leveraging the recently disclosed Follina security vulnerability to distribute a previously undocumented backdoor on Windows systems. "Rozena is a backdoor malware that is capable of injecting a remote shell connection back to the attacker's machine," Fortine...

Migration to a new terminal allows project to use funding again in same funding cycle

Lines of code Vulnerability details Impact Distribution and overflow allowance can be reused after migration Proof of Concept When migrating to a new terminal only balances are transferred but not usedDistributionLimitOf or usedOverflowAllowanceOf. This means that both of these values will be 0,...

Distribution of reserved tokens may run out of gas

Lines of code Vulnerability details Impact If there are enough entries in the splits array, the function that distributes the reserved tokens will run out of gas, and the reserved tokens will be un-distributable until the current cycle is over, and the splits are changed. If cycles are long, the...

The reserves accounting breaks when total balances surpas type(int256).max

Lines of code Vulnerability details Reserved tokens do not get minted automatically when a new payment is received. Instead, they must be explicitly distributed during the funding cycle which contains the reserved rate and splits that should be applied. If a funding cycle's reserved rate or split...

org.eclipse.jetty:jetty-ajp (7.0.0.m0), org.eclipse.jetty:jetty-annotations (7.0.0.m0) +15 more potentially affected by CVE-2022-2047 via org.eclipse.jetty:jetty-http (7.0.0.m0)

org.eclipse.jetty:jetty-http MAVEN version 7.0.0.m0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-http and may be impacted: - org.eclipse.jetty:jetty-ajp 7.0.0.m0 - org.eclipse.jetty:jetty-annotations 7.0.0.m0 -...

Data Distribution Service: Exploring Vulnerabilities and Risks Part 2

In part two of our series, we’ll highlight both known and new DDS vulnerabilities and what they mean for mission critical operations...

Fedora: Security Advisory for golang-github-containerd-stargz-snapshotter (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...