Adobe DNG Software Development Kit Buffer Overflow Vulnerability (CNVD-2020-38191)

Adobe DNG Software Development Kit SDK is a software development kit that provides the ability to read and write DNG files from the American company Audobee Adobe. A buffer overflow vulnerability exists in the Adobe DNG Software Development Kit. An attacker could exploit this vulnerability to...

How a Facebook Bug Took Down Spotify, TikTok, and Other Major iOS Apps

Thank a tiny change to a software development kit for widespread crashes Wednesday, including the Spotify and TikTok apps...

java security update

CentOS Errata and Security Advisory CESA-2020:1507 An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

Targeted Phishing Attacks Successfully Hacked Top Executives At 150+ Companies

In the last few months, multiple groups of attackers successfully compromised corporate email accounts of at least 156 high-ranking officers at various firms based in Germany, the UK, Netherlands, Hong Kong, and Singapore. Dubbed 'PerSwaysion ,' the newly spotted cyberattack campaign leveraged...

How to Use VSSTrace to Collect VSS Diagnostic Logging

Challenge This article explains how to collect additional VSS diagnostic data with the VSSTrace tool, a Microsoft Windows Software Development Kit SDK component. Cause Veeam products use Microsoft Volume Shadow Copy Service VSS for various tasks. Sometimes it is necessary to go through the...

The vulnerability in the collection of libraries and drivers for fast packet processing in dpdk, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the library and driver set for fast packet processing in dpdk is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted VRINGSETNUM messages...

dpdk: possible memory leak leads to denial of service

A flaw was found in dpdk where a malicious master, or a container with access to vhostuser socket, can send specially crafted VRINGSETNUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition...

OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841)

A flaw was found in the boundary checks in the java.nio buffer classes in the Libraries component of OpenJDK, where it is bypassed in certain cases. This flaw allows an untrusted Java application or applet o bypass Java sandbox restrictions...

Accelerator Program for Early-Stage Innovations in Water Update: Introducing our Innovators!

This Earth Day, we are excited to announce the first two grantees of Akamai's Accelerator Program for Early-Stage Innovations in Water: the Ashoka Trust for Research in Ecology and the Environment ATREE and the Foundation for Environmental Monitoring ffem. The Akamai Technologies India Corporate...

OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Lightweight HTTP Server. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network acce...

OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

Important: Red Hat Security Advisory: java-1.7.0-openjdk security update

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

A week in security (April 13 – 19)

Last week on Malwarebytes Labs, we looked at how to avoid Zoom bombing, weighed the risks of surveillance versus pandemics, and dug into a spot of WiFi credential theft. Other cybersecurity news: Malware creeps back into the home: With a pandemic forcing much of the workforce into remote position...

Intel NUC Buffer Overflow Vulnerability

The Intel NUC Kit is a small desktop computer from Intel Corporation USA. A buffer error vulnerability exists in the firmware in the Intel NUC. A local attacker could exploit this vulnerability to elevate privileges...

Oracle Solaris Critical Patch Update : apr2020_SRU11_4_19_3_0

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Sun ZFS Storage Appliance Kit product of Oracle Systems component: Operating System Image. The supported version that is affected is 8.8. Difficult to exploit vulnerability allows low...

Denial Of Service (DoS)

IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit is vulnerable to Denial of Service DoS. The attack exists because it does not prevent remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

Denial Of Services (DoS)

IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit is vulnerable to Denial of Service DoS. The attack exists because it does not prevent remote attackers to affect confidentiality, integrity, and availability via unknown vectors...

Security Bulletin: IBM Security Information Queue does not invalidate sessions after logout (CVE-2020-4291)

Summary IBM Security Information Queue ISIQ session identifiers are not properly invalidated upon user logout from ISIQ's web UI. This create opportunities for an attacker to hijack a user session token. As of v1.0.6, ISIQ immediately invalidates the session token when a user logs out...

CVE-2020-8016

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows...

CVE-2020-8016

CVE-2020-8016 is a local-privilege issue described as a race condition in the packaging of texlive-filesystem affecting SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SLED/SLES 12-SP4/12-SP5, and openSUSE Leap 15.1. The underlying problem: a race condition in linking during packagi...