Design/Logic Flaw

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via...

USN-2053-1: Thunderbird vulnerabilities

Ben Turner, Bobby Holley, Jesse Ruderman and Christian Holler discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application...

Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via...

Thunderbird < 24.2 Multiple Vulnerabilities (Mac OS X)

The installed version of Thunderbird is earlier than 24.2 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - Two use-after-free...

CVE-2013-5613

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via...

Use-after-free in synthetic mouse movement — Mozilla

Security researchers Tyson Smith and Jesse Schwartzentruber of the BlackBerry Security Automated Analysis Team used the Address Sanitizer tool while fuzzing to discover a user-after-free in the functions for synthetic mouse movement handling. Security researcher Atte Kettunen from OUSPG also...

'Let's Do Security That Matters'

NEW YORK–A small group of influential security researchers and executives are putting together a grass-roots movement to encourage more research on the emerging breed of connected and potentially vulnerable devices such as pacemakers, insulin pumps and others and help educate users about the...

DEBIAN-CVE-2013-4592

Memory leak in the kvmsetmemoryregion function in virt/kvm/kvmmain.c in the Linux kernel before 3.9 allows local users to cause a denial of service memory consumption by leveraging certain device access to trigger movement of memory slots...

Unbreakable Enterprise kernel security and bugfix update

2.6.39-400.21.1 - SPEC: v2.6.39-400.21.1 Maxim Uvarov - xen/mmu: On early bootup, flush the TLB when changing RO-RW bits Xen provided pagetables. Konrad Rzeszutek Wilk 2.6.39-400.20.1 - SPEC: v2.6.39-400.20.1 Maxim Uvarov - PCI: Set device power state to PCID0 for device without native PM support...

Design/Logic Flaw

Use-after-free vulnerability in the nsTArraybase::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service...

Mozilla: SVG buffer overflow and use-after-free issues (MFSA 2012-63)

Use-after-free vulnerability in the nsTArraybase::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service...

CVE-2012-3970

Use-after-free vulnerability in the nsTArraybase::Length function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a denial of service...

Scientific Linux Security Update : bash on SL5.x i386/x86_64

Bash is the default shell for Scientific Linux. It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary fil...

Survey Finds Secure Sites Not So Secure

A new project that was setup to monitor the quality and strength of the SSL implementations on top sites across the Internet found that 75 percent of them are vulnerable to the BEAST SSL attack and that just 10 percent of the sites surveyed should be considered secure. The SSL Pulse project, set ...

'The Consortium' Just Called the Movement a 'SLUT '

'The Consortium' Just Called the Movement a 'SLUT' I'm disappointed. At the pinnacle of one of the greatest and most innovative political movements the world has ever seen, you have the new hackers group named "Consortium" bringing the movement to a new low and quite frankly, an embarrassment. Wh...

'The New York Iron Works' police supplier Hacked by Anonymous

'The New York Iron Works' police supplier Hacked by Anonymous Anonymous Hackers with the Antisec movement have attacked the site of a company that sells equipment to US law enforcers such as the police. Members of Anonymous recently hacked the official site for law enforcement equipment supplier...

Adult Site DigitalPlayground.com Hacked: Credit Card Info on 40K Exposed

The adult Web site DigitalPlayground.com was hacked. A group calling itself TheConsortium has claimed credit for the attack, saying it stole credit card information on 40,000 paying customers and even listened in on a company conference call. The compromise occurred on March 4, according to a...

THE "TRUTH" SIMMERS THE POT OF SABU

THE "TRUTH" SIMMERS THE POT OF SABU By: Patti Galle, Editor THN. As I look at my guy fawkes mask and reflect on the recent arrest of several lulzsec members, I have a wrenching feeling in my gut to tell the "truth." Gather around anonymous, lulzsec, FBI, passionate supporters, liberal haters, and...

Greg Hoglund

In his presentation on Friday, “Lateral Movement and Other APT Interaction Patterns within the Enterprise,” HBGary CEO Greg Hoglund reviewed a multitude of modern day Advanced Persistent Threats APTs while breaking down the four stages of an attack...

Privacy and Anonymity on the Modern Internet

The current online atmosphere, in which government-sponsored surveillance, data collection and sale by private companies and politically motivated attacks have become the norm, has spurred a renewed interest in many corners of the Internet in privacy and anonymity. The people behind The Crypto...