Fedora 36 : chromium (2022-b49c9bc07a)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b49c9bc07a advisory. Update to chromium-105.0.5195.125. This package only has minor changes... ah, just kidding. Here is the pile of security issues it fixes:...

BigBlueButton security vulnerability

BigBlueButton is an open source web conferencing system from the BigBlueButton community. A security vulnerability exists in BigBlueButton versions prior to 2.4-rc-6, which stems from the presence of a vulnerability that inserts sensitive information into the sent data, does not enforce the use o...

Worldwide law enforcement action takes down major DDoS booter services

Criminals making use of booter services which execute Distributed Denial of Service DDoS attacks to take down websites will have to try a little bit harder today: A major international operation has taken no fewer than 48 of the most popular booter services offline. The operation, known as "Power...

FBI Charges 6, Seizes 48 Domains Linked to DDoS-for-Hire Service Platforms

The U.S. Department of Justice DoJ on Wednesday announced the seizure of 48 domains that offered services to conduct distributed denial-of-service DDoS attacks on behalf of other threat actors, effectively lowering the barrier to entry for malicious activity. It also charged six suspects – Jeremi...

limits are not correctly enforced in withdrawHook contract

Lines of code Vulnerability details Impact withdrawHook contract checks that inside a specified length of time only certain amount of withdrawal are possible per user and globally. But on every period reset the allowed withdraw limit check is missing. And a user can withdraw more that is allowed...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists due to lack of validate in frame restrictions which allows an attacker to bypass fenced via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists due to insufficient policy enforcement in popup blocker, which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists due to insufficient policy enforcement in autofills, which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists due to insufficient policy enforcement in devtools, which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement.The vulnerability exists due to Insufficient policy enforcement in devtools, which allows a remote attacker to bypass navigation restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists because of improper data validation in directories, which allows attackers to bypass file system restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is vulnerable to insufficient policy enforcement. The vulnerability exists because of the file system api in google chrome which allows attackers to bypass file system restrictions via a crafted HTML page...

Insufficient Policy Enforcement

chromium is using Insufficient policy enforcement. The vulnerability exists due to the insufficient policy enforcement in the library, allowing an attacker to bypass the safe browsing warnings via a malicious file...

GSD-2022-1007991 netfilter: ipset: enforce documented limit to prevent allocating huge memory

netfilter: ipset: enforce documented limit to prevent allocating huge memory This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.78 by commit...

GSD-2022-1007879 macvlan: enforce a consistent minimal mtu

macvlan: enforce a consistent minimal mtu This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.80 by commit...

PT-2022-36536

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.300 Description The issue concerns the macvlan component, where a consistent minimal MTU is not enforced. This is an automated ID intended to aid in discovery of potential security vulnerabilities, and the...

PT-2022-36469 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: The issue concerns the macvlan component, where a consistent minimal MTU is not enforced. This is an automated ID intended to aid in discovery of potential security vulnerabilities, and th...

The Dangerous Digital Creep of Britain's ‘Hostile Environment’

The UK's use of technology to enforce its hard-line immigration policy brings the border into every facet of migrants' lives...

Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...

GHSA-X45C-CVP8-Q4FM Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operato...