EulerOS 2.0 SP10 : gcc (EulerOS-SA-2023-3174)

According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in...

EulerOS 2.0 SP9 : gcc (EulerOS-SA-2023-3328)

According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in...

EulerOS Virtualization 2.10.0 : gcc (EulerOS-SA-2023-3469)

According to the versions of the gcc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing...

Malware in schibsted-style

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in schibsted-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7fdb3f96b7ef1c18a21e73ccf0e66681bb101c779b67ef16b78444bb7ce249f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-81 Malicious code in schibsted-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7fdb3f96b7ef1c18a21e73ccf0e66681bb101c779b67ef16b78444bb7ce249f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

nss: timing attack against RSA decryption

It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether high order bits of the RSA decryption result are zero. This information can be used to mount a Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens...

Friday Squid Blogging: Sqids

Theyre short unique strings: Sqids pronounced "squids" is an open-source library that lets you generate YouTube-looking IDs from numbers. These IDs are short, can be generated from a custom alphabet and are guaranteed to be collision-free. I havent dug into the details enough to know how they can...

SUSE SLES15: gnutls / libgnutls-devel / libgnutls30 / libgnutls30-32bit / etc (SUSE-SU-2023:4952-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4952-1 advisory. - CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange bsc1208143. - CVE-2023-5981: Fixed timing side-channel...

Update your browser: Security fixes for latest Chrome zero-day

News, Security Update your browser: Security fixes for latest Chrome zero-day Share December 22nd, 2023 Hi everyone! The latest patches to the Opera, Opera GX, Opera Crypto, and Opera for Android browsers address several recent vulnerabilities, including a zero-day exploit CVE-2023-7024. We...

Alert: Chinese-Speaking Hackers Pose as UAE Authority in Latest Smishing Wave

The Chinese-speaking threat actors behind Smishing Triad have been observed masquerading as the United Arab Emirates Federal Authority for Identity and Citizenship to send malicious SMS messages with the ultimate goal of gathering sensitive information from residents and foreigners in the country...

php: potential exposure to Marvin attack via unsafe implementation of RSA decryption API

The RSA decryption implementation using PKCS1 v1.5 padding in OpenSSL is vulnerable to a timing side-channel attack known as the Marvin Attack. This vulnerability arises because the execution time of the opensslprivatedecrypt function in PHP with OpenSSL varies based on whether a valid message is...

The vulnerability of Google Chrome’s CSS component allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s CSS component is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created malicious web page...

DEBIAN-CVE-2023-6707

Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2023-4421

The NSS code used for checking PKCS1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding as well as the length of the encrypted message was leaking through timing side-channel. By sending large number of attacker-selected...

Internet Bug Bounty: OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)

A timing side channel vulnerability in OpenSSL RSA decryption was discovered that could allow plaintext recovery. By measuring decryption time, an attacker could recover RSA plaintext from captured ciphertexts after a large number of decryption attempts. All RSA padding modes were affected. The...

qt:qtsvg_svg_qsvgrenderer_render: Global-buffer-overflow in QSvgStyleSelector::nodeNames

Detailed Report: https://oss-fuzz.com/testcase?key=4922028708462592 Project: qt Fuzzing Engine: afl Fuzz Target: qtsvgsvgqsvgrendererrender Job Type: aflasanqt Platform Id: linux Crash Type: Global-buffer-overflow READ 8 Crash Address: 0x000002d70c98 Crash State: QSvgStyleSelector::nodeNames...

PT-2023-32551 · WordPress · Mainwp Dashboard

Name of the Vulnerable Software and Affected Versions: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress versions up to, and including, 4.5.1.2 Description: The issue allows authenticated attackers with administrator-level access to inject arbitrary CSS...

Malware in frontend-style-janus

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PT-2023-7683 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.109 Description: The issue is related to a use after free in CSS, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized...