RHEL 7 : Virtualization (RHSA-2018:0048) (Spectre)

An update for vdsm is now available for RHEV 3.X Hypervisor and Agents for Red Hat Enterprise Linux 7 ELS. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

macOS : Apple Safari <= 11.0.2 (11604.4.7.1.6 / 12604.4.7.1.6 / 13604.4.7.10.6) Information Disclosure (Spectre)

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 11.0.2, or is 11.0.2 and missing the January 8th patch. It is, therefore, affected by a vulnerability that exists within microprocessors utilizing speculative execution and indirect branch prediction, which may...

RHEL 7 : redhat-virtualization-host (RHSA-2018:0047) (Meltdown) (Spectre)

An update for redhat-virtualization-host is now available for RHEV 4.X, RHEV-H, and Agents for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Apple Releases Spectre Patches for Safari, macOS and iOS

Apple released iOS 11.2.2 software Monday for iPhones, iPads and iPod touch models that patch for the Spectre vulnerabilities. A macOS High Sierra 10.13.2 supplemental update was also released to bolster Spectre defenses in Apple’s Safari browser and WebKit, the web browser engine used by Safari,...

January 8, 2017 – Morning Cyber Coffee Headlines – “Golden Globes” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 8, 2018 - Headlines Carbon Black in the News: Carbon Black 2017 Threat...

Spectre-Meltdown-Checker - Spectre & Meltdown Vulnerability/Mitigation Checker For Linux

A simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs: CVE-2017-5753 bounds check bypass Spectre Variant 1 Impact: Kernel & all software Mitigation: recompile software and kernel with a modified compiler that introduces the LFENCE opcode...

About the security content of iOS 11.2.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of Safari 11.0.2 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

About the security content of macOS High Sierra 10.13.2 Supplemental Update - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

Meltdown and Spectre

Cisco Talos is aware of three new vulnerabilities impacting Intel, AMD, Qualcomm and ARM processors used by almost all computers. We are investigating these issues and although we have not observed exploitation of these vulnerabilities in the wild, that does not mean that it has not occurred. We...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

About the security content of iOS 11.2.2

About the security content of iOS 11.2.2 This document describes the security content of iOS 11.2.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

Important kernel security update: Fixes for Meltdown and Spectre exploits; new kernel 3.10.0-693.11.6.vz7.40.4, Virtuozzo 7.0 Update 6 Hotfix 3 (7.0.6-710)

This update provides a new Virtuozzo 7.0 kernel 3.10.0-693.11.6.vz7.40.4 that is a rebase to the Red Hat Enterprise Linux 7 kernel 3.10.0-693.11.6.el7. The rebase fixes an industry-wide issue that was found in the way many modern microprocessor designs have implemented speculative execution of...

openSUSE Security Update : ucode-intel (openSUSE-2018-4) (Spectre)

This update for ucode-intel fixes the following issues : The CPU microcode for Haswell-X, Skylake-X and Broadwell-X chipsets was updated to report both branch prediction control via CPUID flag and ability to control branch prediction via an MSR register. This update is part of a mitigation for a...

openSUSE Security Update : qemu (openSUSE-2018-8) (Spectre)

This update for qemu fixes the following issues : A new feature was added : - Support EPYC vCPU type bsc1052825 fate324038 Also a mitigation for a security problem has been applied : - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to...

Meltdown and Spectre - Impact On Node.js

Meltdown and Spectre - Impact On Node.js Summary Project zero has recently announced some new attacks that have received a lot of attention: https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html. The risk from these attacks to systems running Node.js resides in th...

About the security content of macOS High Sierra 10.13.2 Supplemental Update

About the security content of macOS High Sierra 10.13.2 Supplemental Update This document describes the security content of macOS High Sierra 10.13.2 Supplemental Update. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until ...

About the security content of Safari 11.0.2

About the security content of Safari 11.0.2 This document describes the security content of Safari 11.0.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

openSUSE Security Update : kernel-firmware (openSUSE-2018-9) (Spectre)

This update for kernel-firmware fixes the following issues : - Add microcodeamdfam17h.bin bsc1068032 CVE-2017-5715 This new firmware disables branch prediction on AMD family 17h processor to mitigate an attack on the branch predictor that could lead to information disclosure from e.g. kernel memo...

RHEL 7 : linux-firmware (RHSA-2018:0053) (Spectre)

An update for linux-firmware is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update Support, and Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a securi...