Ubuntu: Security Advisory (USN-3836-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2018:3835-1 Security update for chromium

This update contains Chromium 70.0.3538.102 and fixes security issues and bugs. Vulnerabilities fixed in 70.0.3538.102: - CVE-2018-17478: Out of bounds memory access in V8 boo1115537 Vulnerabilities fixed in 70.0.3538.67 bsc1112111: - CVE-2018-17462: Sandbox escape in AppCache - CVE-2018-17463:...

insufficient TLB flushing / improper large page mappings with AMD IOMMUs

ISSUE DESCRIPTION In order to be certain that no undue access to memory is possible anymore after IOMMU mappings of this memory have been removed, Translation Lookaside Buffers TLBs need to be flushed after most changes to such mappings. Xen bypassed certain IOMMU flushes on AMD x86 hardware...

Kaspersky Security Bulletin 2018. Threat Predictions for 2019

Cryptocurrency threat predictions for 2019 Threat predictions for industrial security in 2019 Cyberthreats to financial institutions 2019: overview and predictions There's nothing more difficult than predicting. So, instead of gazing into a crystal ball, the idea here is to make educated guesses...

PT-2018-10958 · Samsung +1 · Samsung T5 +6

Name of the Vulnerable Software and Affected Versions: Samsung 840 EVO versions affected versions not specified Samsung 850 EVO versions affected versions not specified Samsung T3 versions affected versions not specified Samsung T5 versions affected versions not specified Crucial MX100 versions...

Siemens SIMATIC HMI Device Detection Consolidation

Consolidation of Siemens SIMATIC HMI device detections. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

TP-Link Archer C50 Wireless Router 171227 - CSRF (Configuration File Disclosure) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: TP-Link Archer C50 Wireless Router 171227 - Cross-Site Request Forgery Configuration File Disclosure Exploit Author: Wadeek Vendor Homepage: https://www.tp-link.com/ Hardware Version: Archer C50 v3 00000001 Firmware Link:...

Apple Modernizes Its Hardware Security with T2

When Apple launched its latest MacBook Air last month, one of its more unusual features is that the built-in microphone automatically turns off when the lid is closed. Apple introduced the feature to eliminate any possibility of malware – or other unwanted applications – using the laptop’s...

The x86 Processor Fuzzer: sandsifter

Your computer is not yours. You may have shelled out thousands of dollars for it. It may be sitting right there on your desk. You may have carved your name deep into its side with a blowtorch and chisel. But it’s still not yours. Some vendors are building secret processor registers into your...

The vulnerability of Microsoft Hyper-V hardware virtualization system for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of Microsoft Hyper-V hardware virtualization technology for Windows operating systems exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code on the host operating system through a specially created...

Guidance for configuring BitLocker to enforce software encryption

Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives SEDs. Customers concerned about this issue should consider using the software only encryption provided by BitLocker Drive Encryption™. On Windows computers with self-encrypting drives,...

KLA11345 Guidance for configuring BitLocker to enforce software encryption

Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives and recommends customers to use the software only encryption provided by BitLocker Drive Encryption. For the details, see ADV180028 Original advisories ADV180028 Exploitation Related...

Self-Encrypting Solid-State Drive Vulnerabilities

NCCIC is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting solid-state drives. An attacker could exploit these vulnerabilities to obtain access to sensitive information. NCCIC encourages users and administrators to review Vulnerability Note VU 395981,...

ReFS Known Issues, Considerations, and Limitations

Known Issues Memory Management Issues Server 2016 and older Windows repositories using ReFS on Server 2016 without the September 2018 updates or older OS versions are known to have issues during backup job retention enforcement, which manifests as: The repository server becomes unresponsive or...

kernel security, bug fix, and enhancement update

3.10.0-957 - mm mlock: avoid increase mm-lockedvm on mlock when already mlock2, MLOCKONFAULT Rafael Aquini 1633059 3.10.0-956 - block blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug Ming Lei 1619988 - nvme nvme-pci: unquiesce dead controller queues Ming Lei...

F5 Networks BIG-IP : vCMP Cavium Nitrox SSL hardware accelerator vulnerability (K52521791)

vCMP guests running on VIPRION 2100, 4200 and 4300 series blades cannot correctly decrypt ciphertext from established SSL sessions with small MTU. CVE-2018-5507 Impact BIG-IP The affected SSL connections are terminated unexpectedly. ARX / BIG-IQ / Enterprise Manager / F5 iWorkflow / LineRate /...

F5 Networks BIG-IP : Side-channel processor vulnerabilities (K91229003)

The following three side-channel attacks were publicly disclosed on January 3, 2018 : CVE-2017-5715 Spectre-BTB previously known as Spectre Variant 2 Branch target injection Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosu...

F5 Networks BIG-IP : BIG-IP system vulnerability (K51754851)

WhenLarge Receive OffloadLROand SYN cookies are enabled default settings, undisclosed traffic patterns may cause TMM to restart. CVE-2018-5512 Impact An attacker may be able to causea disruption of service. Exposure to this vulnerability is limited to the data plane on hardwareplatforms. There is...

ALPINE-CVE-2018-18883

An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service NULL pointer dereference or possibly have unspecified other impact because nested VT-x is not properly restricted...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...