pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode

An out-of-bounds read was discovered in PCRE when the pattern "\X" is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to crash the application...

Best practices for defending Azure Virtual Machines

One of the things that our Detection and Response Team DART and Customer Service and Support CSS security teams see frequently during investigation of customer incidents are attacks on virtual machines from the internet. This is one area in the cloud security shared responsibility model where...

USN-4501-1: LuaJIT vulnerability

It was discovered that an out-of-bounds read existed in LuaJIT. An attacker could use this to cause a denial of service application crash or possibly expose sensitive information. CVE-2020-15890...

CVE-2020-15656

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR 78.1, Firefox 79, and Thunderbird 78.1...

Debian: Security Advisory (DLA-2296-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2019-20838

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454...

Defending the power grid against supply chain attacks: Part 3 – Risk management strategies for the utilities industry

Over the last fifteen years, attacks against critical infrastructure figure1 have steadily increased in both volume and sophistication. Because of the strategic importance of this industry to national security and economic stability, these organizations are targeted by sophisticated, patient, and...

Enable remote work while keeping cloud deployments secure

As our customers shift to remote work in response to the COVID-19 outbreak, many have asked how to maintain the security posture of their cloud assets. Azure Security Center security controls can help you monitor your security posture as usage of cloud assets increases. These are three common...

Defending the power grid against supply chain attacks—Part 2: Securing hardware and software

Artificial intelligence AI and connected devices have fueled digital transformation in the utilities industry. These technological advances promise to reduce costs and increase the efficiency of energy generation, transmission, and distribution. They’ve also created new vulnerabilities...

The vulnerability of the IonMonkey Just-In-Time compiler in Thunderbird email clients, as well as in Firefox and Firefox ESR browsers, stems from incorrect type conversion. This allows attackers to trigger a service failure.

The vulnerability of the IonMonkey Just-In-Time compiler for Thunderbird email clients, as well as for Firefox and Firefox ESR browsers, is related to incorrect type conversion. Exploiting this vulnerability can allow a remote attacker to cause service interruptions through the use of specially...

Mitigating Modern Insider Threats in FIs

More and more financial institutions FI are migrating to the cloud—increasing efficiencies and access to services. With this move, however, comes a new degree of risk. Without the right levels of protection and visibility, you leave yourself open not only to attacks by external actors but interna...

How to Scale Addressable Advertising with Low Latency for Live Streaming

Written by: David Springfall, Founder and CTO of Yospace Under David's technical and strategic leadership, Yospace pioneered server-side ad insertion and established itself as the global leader in OTT stream monetisation. The Yospace technology supports full one-to-one personalisation and provide...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

Hardcoded credentials

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

EulerOS 2.0 SP5 : gnutls (EulerOS-SA-2019-1676)

According to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A cache-based side channel attack was found in the way GnuTLS implements CBC-mode cipher suites. An attacker could use a combination of 'Just in...

The vulnerability of the Just-In-Time (JIT) compiler of IonMonkey in web browsers Firefox, Firefox ESR, and the email processing program Thunderbird, related to data writing beyond buffer boundaries, allows an attacker to trigger a service failure.

The vulnerability of the Just-In-Time JIT compiler in IonMonkey web browsers—Firefox, Firefox ESR, and the email processing program Thunderbird—is related to data writing beyond buffer boundaries and memory corruption. Exploiting this vulnerability can allow an attacker to cause service...

UBUNTU-CVE-2019-9791

The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time JIT compiler and when the constructor function is entered through on-stack replacement OSR. This allows for possible arbitrary...

Amazon Linux 2 : gnutls (ALAS-2018-1120)

It was found that GnuTLS's implementation of HMAC-SHA-256 was vulnerable to Lucky Thirteen-style attack. A remote attacker could use this flaw to conduct distinguishing attacks and plain text recovery attacks via statistical analysis of timing data using crafted packets.CVE-2018-10844 It was foun...

Oracle Linux 7 : gnutls (ELSA-2018-3050)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3050 advisory. - Improved counter-measures in TLS CBC record padding for lucky13 attack CVE-2018-10844, 1589704, CVE-2018-10845, 1589707 - Added counter-measures for...