SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2017:2589-1)

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed : - CVE-2017-7807 Domain hijacking through AppCache fallback bsc1052829 - CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts bsc1052829 - CVE-2017-7792 Buffer...

SUSE-SU-2017:2589-1 Security update for MozillaFirefox

This update for MozillaFirefox to ESR 52.3 fixes several issues. These security issues were fixed: - CVE-2017-7807 Domain hijacking through AppCache fallback bsc1052829 - CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts bsc1052829 - CVE-2017-7792 Buffer overfl...

eNom Inter-Account Transfer Issue

the m group security advisory 2017090100: Zero-confirmation inter-account transfers of .uk domains with eNom Discovery date: 2017-05-02 Publish date: 2017-09-01 +122 days Product: https://www.enom.com/, the website for eNom Inc. and their APIs, all eNom resellers Vulnerable: yes, as of publicatio...

SUSE-SU-2017:2302-1 Security update for MozillaFirefox

Mozilla Firefox was updated to the ESR 52.3 release bsc1052829 Following security issues were fixed: MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts MFSA 2017-19/CVE-2017-779...

Mozilla: Domain hijacking through appcache fallback (MFSA 2017-19)

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. This vulnerability affects Thunderbird 52.3, Firefox ESR 52.3, and Firefox 55...

openSUSE Security Update : MozillaThunderbird (openSUSE-2017-955)

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed : - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with...

Security update for MozillaThunderbird (important)

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs. The following vulnerabilities were fixed: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection - CVE-2017-7801: Use-after-free with marqu...

Security update for MozillaFirefox (important)

This update to Mozilla Firefox 52.3esr fixes a number of security issues. The following vulnerabilities were advised upstream under MFSA 2017-19 boo1052829: - CVE-2017-7798: XUL injection in the style editor in devtools - CVE-2017-7800: Use-after-free in WebSockets during disconnection -...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2017:2151-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Mozilla Firefox and Firefox ESR Domain Hijacking Vulnerability

Mozilla Firefox and Firefox ESR are both browser products developed by the Mozilla Foundation in the U.S. Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox. A domain hijacking vulnerability exists in Mozilla Firefox versions prior to 55 and Firefox ESR...

Security fix for the ALT Linux 10 package firefox-esr version 52.3.0-alt1

Aug. 8, 2017 Andrey Cherepanov 52.3.0-alt1 - New ESR version 52.3.0 - Security fixes: + CVE-2017-7798: XUL injection in the style editor in devtools + CVE-2017-7800: Use-after-free in WebSockets during disconnection + CVE-2017-7801: Use-after-free with marquee during window resizing +...

A week in security (July 10 – July 16)

Last week, we took a look at some of your malware infection stories, took a stroll through the basics of PowerShell, explored a piece of .NET malware, and shone the spotlight on the Petya ransomware family. Elsewhere, the following stories were taking place: Latest updates for Consumers...

The vulnerability of Google Chrome allows a violator to perform domain substitution.

The vulnerability of Google Chrome relates to the improper processing of Unicode characters. Exploiting this vulnerability allows a malicious actor to perform domain hijacking using IDN homographs in a specially created domain name...

Respect My Authority – Hijacking Broken Nameservers to Compromise Your Target

In a past piece of research, we explored the issue of nameserver domains expiring allowing us to take over full control of a target domain. In that example we took over the domain name maris.int by buying an expired domain name which was authoritative for the domain. This previous example happene...

LocalTapiola: Open Redirect bypass and cookie leakage on www.lahitapiola.com

Basic report information Summary: An attacker is able to steal some of the cookies and redirect the user to his webpage. Domain: www.lahitapiola.com Browsers / Apps Verified In: Google Chrome without user interaction Firefox firefox will popup when is someone trying to authenticate you to another...

New Relic: Potential sub-domain hijacking

Hey New Relic Security team, I noticed what appeared to be a configuration oversight and I wanted to mention it to you. The following domains are currently pointing to Fastly: fr.newrelic.com 151.101.192.207 es.newrelic.com 151.101.0.207 When you visit them, you should see something like this:...

The value of a million dollars of vulnerability can be read Uber's internal mail-vulnerability warning-the black bar safety net

! Overview It is understood, Uber site system and broke a vulnerability, an attacker or exploit the vulnerability feel free to read Uber's internal mail. And according to Uber, the company's vulnerability reward program, the vulnerability of the value of about one million dollars. Write in front ...

D-Link router firmware the back door that leads within the network domain name hijacking-vulnerability warning-the black bar safety net

This Backdoor can lead to a domain being hijacked, hijacking of domain names is available in the remote server control, with the back door of the firmware: DI7001-15.07. 15A1. trx DI7001W-15.07. 15A1. trx DI7002-15.07. 15A1. trx DI7002W-15.07. 15A1. trx DI7008W-14.10. 11A1. trx DI7100-15.07. 15A1...

Seized Megaupload Domain Hijacked to Host Malicious Ads

Well, we all know that the FBI has previously hosting adult videos on the Internet. I still remember the case of PlayPen, the world's largest dark web prngraphy site, which was seized by FBI and ran from agency’s own servers to uncover the site's visitors. Now, one of the most popular sites owned...

Safari Cross-Domain Hijacking

OVERVIEW ========== The 4/8/2015 security updates from Apple included a patch for a Safari cross-domain vulnerability. An attacker could create web content which, when viewed by a target user, bypasses some of the normal cross-domain restrictions to access or modify HTTP cookies belonging to any...