Critical RCE Flaw in Linux APT Allows Remote Attackers to Hack Systems

Just in time… Some cybersecurity experts this week arguing over Twitter in favor of not using HTTPS and suggesting software developers to only rely on signature-based package verification, just because APT on Linux also does the same. Ironically, a security researcher just today revealed details ...

SUSE SLES15 Security Update : helm-mirror (SUSE-SU-2019:0048-1)

This update for helm-mirror to version 0.2.1 fixes the following issues : Security issues fixed : CVE-2018-16873: Fixed a remote command execution bsc1118897 CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path bsc1118898 CVE-2018-16875: Fixed a CPU denial of...

SUSE-SU-2019:0048-1 Security update for helm-mirror

This update for helm-mirror to version 0.2.1 fixes the following issues: Security issues fixed: - CVE-2018-16873: Fixed a remote command execution bsc1118897 - CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path bsc1118898 - CVE-2018-16875: Fixed a CPU denial o...

PT-2018-3094

Name of the Vulnerable Software and Affected Versions Hex package manager versions 0.14.0 through 0.18.2 Description The issue is related to insufficient input validation in the Hex package manager, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by...

[slackware-security] mozilla-nss

New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-nss-3.40.1-i586-1slack14.2.txz: Upgraded. Upgraded to nss-3.40.1 and nspr-4.20. Mitigate cache side-channel...

campbellrivermirror.com XSS vulnerability

Open Bug Bounty ID: OBB-694567 Description| Value ---|--- Affected Website:| campbellrivermirror.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

[slackware-security] libssh

New libssh packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libssh-0.7.6-i586-1slack14.2.txz: Upgraded. Fixed authentication bypass vulnerability. For more information, see:...

USN-3746-1: APT vulnerability | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that APT incorrectly handled the mirror method mirror://. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to install altered...

DNC: Highly Publicized ‘Phishing Attempt’ Was Only a Security Test

A day after the Democratic National Committee riled up security researchers and the press, it’s walking back an assertion that there was an attempt to compromise its voter database. Though it seemed like the event was the latest in a series of malicious efforts designed to harvest credentials...

Design/Logic Flaw

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

DEBIAN-CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501: Improper Verification of Cryptographic Signature

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

Ubuntu 18.04 LTS : APT vulnerability (USN-3746-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3746-1 advisory. It was discovered that APT incorrectly handled the mirror method mirror://. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

USN-3746-1 apt vulnerability

It was discovered that APT incorrectly handled the mirror method mirror://. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages in environments configured to use mirror:// entries...

USN-3746-1: APT vulnerability

It was discovered that APT incorrectly handled the mirror method mirror://. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages in environments configured to use mirror:// entries...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

PT-2018-8863 · Debian +1 · Apt +1

Name of the Vulnerable Software and Affected Versions: Advanced Package Tool APT versions 1.6.x through 1.6.3 Advanced Package Tool APT versions 1.7.x through 1.7.0alpha2 Description: The issue concerns the mirror:// method implementation in APT, which mishandles gpg signature verification for th...

UBUNTU-CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...