bsdcpio, bsdtar, libarchive security update

CentOS Errata and Security Advisory CESA-2016:1844 An update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

libarchive security update

CentOS Errata and Security Advisory CESA-2016:1850 An update for libarchive is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Scientific Linux Security Update : libarchive on SL6.x i386/x86_64 (20160912)

Security Fixes : - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive...

Important: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

libarchive: Undefined behavior / invalid shiftleft in TAR parser

Undefined behavior invalid left shift was discovered in libarchive, in how Compress streams are identified. This could cause certain files to be mistakenly identified as Compress archives and fail to read...

libarchive: Undefined behavior / invalid shiftleft in TAR parser

Undefined behavior invalid left shift was discovered in libarchive, in how Compress streams are identified. This could cause certain files to be mistakenly identified as Compress archives and fail to read...

libarchive: undefined behaviour (integer overflow) in iso parser

Undefined behavior signed integer overflow was discovered in libarchive, in the ISO parser. A crafted file could potentially cause denial of service...

FTC Panel Encourages Basic Security Hygiene to Counter Ransomware

When asked to describe what it’s like to deal with the constantly looming threat of ransomware, Chad Wilson, the Director of Information Security at Children’s National Medical Center in Washington D.C., didn’t beat around the bush. “I’ll sum it up in one word: It’s scary,” Wilson said at a Feder...

Warning! This Cross-Platform Malware Can Hack Windows, Linux and OS X Computers

Unlike specially crafted malware specifically developed to take advantage of Windows operating system platform, cyber attackers have started creating cross-platform malware for wider exploitation. Due to the rise in popularity of Mac OS X and other Windows desktop alternatives, hackers have begun...

Packet Capture Generator for IDS: Sniffles

Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or rules and...

Timing of Browser-Based Security Alerts Could Be Better

Multitasking may be the way of the connected world, but as it turns out, it’s not conducive to secure behavior online. Academics from Brigham Young University and the University of Pittsburgh came to that conclusion after using functional magnetic resonance imaging fMRI to study how the brain...

Manalyze - A static analyzer for PE executables

Manalyzer is a free service which performs static analysis on PE executables to detect undesirable behavior. A static analyzer for PE files Manalyze was written in C++ for Windows and Linux and is released under the terms of the GPLv3 license . It is a robust parser for PE files with a flexible...

How to Configure Default Device Access Behavior of Workspace app for Windows

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149for more information. Citrix Virtual Apps and Desktops, formerly XenDesktop, fits the enterprise need to bring both VDI and...

HackerOne: Ability to monitor reports' submission in real time

Hey , I would like to report an issue with the server responses that allow anyone users to monitor and track the reports' submission and the platform activity . Description : The issue occurs on the endpoint '/reports/reportid.json' due to the difference between server responses for submitted...

Debian DSA-3642-1 : lighttpd - security update

Dominic Scheirlinck and Scott Geary of Vend reported insecure behavior in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables, allowing remote attackers to carry out Man in the Middle MITM attacks or initiate connections ...

Security update for java-1_8_0-openjdk (important)

This update for java-180-openjdk fixes the following issues: - Upgrade to version jdk8u101 icedtea 3.1.0 - New in release 3.1.0 2016-07-25: Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 -...

Receiver 4 Upgrade Causing UAC Prompt

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information We are offering Receiver from our SCCM 2012 Self-Service Application Catalog. We followed...

Arbitrary Command Execution Vulnerability in D-Link Internet Behavior Management System

Internet behavior management system, a network auditing device. The product suffers from an arbitrary command execution vulnerability that can be exploited by an attacker to gain server privileges...

Arbitrary Command Execution Vulnerability in Internet Audit Device of Shenzhen Aolian Information Security Technology Co.

Shenzhen Aolian Information Security Technology Co., Ltd. Internet access auditing device is a network behavior management system. Shenzhen Aolian Information Security Technology Co., Ltd. Internet Audit Equipment has an arbitrary command execution vulnerability, which can be exploited by attacke...

Arbitrary Command Execution Vulnerability in Internet Behavior Management System of Shanghai Bingfeng Computer Network Technology Co.

Shanghai Bingfeng Computer Network Technology Co., Ltd Internet behavior management system is a network audit equipment. The Internet behavior management system of Shanghai Bingfeng Computer Network Technology Co., Ltd. has an arbitrary command execution vulnerability, which can be exploited by...