Contact Tracing COVID-19 Infections via Smartphone Apps

Google and Apple have announced a joint project to create a privacy-preserving COVID-19 contact tracing app. Details, such as we have them, are here. It's similar to the app being developed at MIT, and similar to others being described and developed elsewhere. It's nice seeing the privacy...

Google and Apple Plan to Turn Phones into COVID-19 Contact-Tracking Devices

Tech giants Apple and Google have joined forces to develop an interoperable contact-tracing tool that will help individuals determine if they have come in contact with someone infected with COVID-19. As part of this new initiative, the companies are expected to release an API that public agencies...

Apple, Google Team on Coronavirus Tracking – Sparking Privacy Fears

Apple and Google are teaming up to launch technology that traces the spread of the coronavirus, via apps for iOS and Android users. Despite the companies’ insistence that privacy will be “of utmost importance,” some in the security space remain wary of data privacy concerns around the newly...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. This race condition can occur when the process tracing and the process being traced participate in a core dump. A local, unprivileged user could use this flaw to trigger a deadlock, resulting in a partial denial of service...

Clever Cryptography Could Protect Privacy in Covid-19 Contact-Tracing Apps

Researchers are racing to achieve the benefits of location-tracking without the surveillance...

io.micronaut.configuration:micronaut-netflix-ribbon (=1.1.0), io.micronaut.configuration:micronaut-security-oauth2 (>=1.3.0 <=1.3.1) +3 more potentially affected by CVE-2020-7611 via io.micronaut:micronaut-http-client (>=1.3.0 <=1.3.1)

io.micronaut:micronaut-http-client MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2020-7611 Source advisory: OSV:GHSA-694P-XRHG-X3WM...

CVE-2019-19072

A flaw was found in the way the predicateparse function in the tracing subsystem of the Linux kernel handled resource cleanup on error. This flaw allows an attacker with the ability to produce the error to crash the system. Mitigation Mitigation for this issue is either not available or the...

io.micronaut.configuration:micronaut-netflix-ribbon (=1.1.0), io.micronaut.configuration:micronaut-security-oauth2 (>=1.3.0 <=1.3.1) +3 more potentially affected by CVE-2020-7611 via io.micronaut:micronaut-http-client (>=1.3.0 <=1.3.1)

io.micronaut:micronaut-http-client MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.1 Source cves: CVE-2020-7611 Source advisory: SNYK:JAVA-IOMICRONAUT-561342...

Microsoft Windows Kernel Privilege Escalation Exploit

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Tracing...

TP-Link TL-WR849N Command Execution Vulnerability

The TP-LINK TL-WR849N is a 300mbps WiFi router. A security vulnerability exists in the diagnostics area of the TP-Link TL-WR849N version 0.9.1 4.16. The vulnerability can be exploited by an attacker to execute commands by sending shell metacharacters to the dashboard's route tracing feature...

Microsoft Windows Service Tracing Arbitrary File Move Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Tracing...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2019-1532)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-4225-2)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4225-2 advisory. USN-4225-1 fixed vulnerabilities in the Linux kernel for Ubuntu 19.10. This update provides the corresponding updates for the Linux Hardware Enablement H...

USN-4225-2: Linux kernel (HWE) vulnerabilities

USN-4225-1 fixed vulnerabilities in the Linux kernel for Ubuntu 19.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 19.10 for Ubuntu 18.04 LTS. It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4225-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4225-1 advisory. It was discovered that a heap-based buffer overflow existed in the Marvell WiFi-Ex Driver for the Linux kernel. A physically proximate attacker could use...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4226-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4226-1 advisory. Michael Hanselmann discovered that the CIFS implementation in the Linux kernel did not sanitize paths returned by an SMB server. An attacker controlling ...

Moderate: Red Hat Security Advisory: libqb security and bug fix update

An update for libqb is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

kernel: use-after-free in SMB2_write function in fs/cifs/smb2pdu.c

An flaw was discovered in the Linux kernel's CIFS client implementation. While issuing an SMB2write, a value can be used after it was intended to be freed when CIFS function tracing is enabled. Even though the data is used after being freed, using it to for privilege escalation does not seem...

kernel: use-after-free information leak in SMB2_read

An issue was discovered in the Linux kernel's implementation of the CIFS protocol. The SMB2read function has a possible use-after-free when CIFS function tracing is enabled. While data is used after being freed, it is has not been determined how it could be used for privilege escalation...

Security Bulletin: IBM MQ is vulnerable to a denial of service attack caused by an error within the tracing functionality. (CVE-2019-4491)

Summary An error was found within the IBM MQ tracing functionality that would allow an attacker to execute a denial of service attack against IBM MQ. Vulnerability Details CVEID: CVE-2019-4491 DESCRIPTION: IBM MQ is vulnerable to a denial of service attack caused by an error within the tracing...