DLA-382-1 sudo - security update

Bulletin has no description...

Updated armagetron package fixes security vulnerabilities

A practically exploitable bug was fixed in the network error handling. In client mode, any received packet that causes an exception during processing would terminate the connection to the server. Another theoretically exploitable bug was fixed that allowed very short UDP packets to cause a memory...

MGASA-2016-0003 Updated armagetron package fixes security vulnerabilities

A practically exploitable bug was fixed in the network error handling. In client mode, any received packet that causes an exception during processing would terminate the connection to the server. Another theoretically exploitable bug was fixed that allowed very short UDP packets to cause a memory...

CVE-2015-8931

Multiple integer overflows in the 1 gettimetmax and 2 gettimetmin functions in archivereadsupportformatmtree.c in libarchive before 3.2.0 allow remote attackers to have unspecified impact via a crafted mtree file, which triggers undefined behavior...

PT-2015-7842

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.2.0 Description The issue is related to multiple integer overflows in the get time t max and get time t min functions in archive read support format mtree.c. This can be triggered by a crafted mtree file, leading...

Jail Authorities Mistakenly Early Released 3,200 Prisoners due to a Silly Software Bug

Washington State Department of Corrections DoC is facing an investigation after it early released around 3,200 prisoners over the course of 13 years, since 2002, when a bug was introduced in the software used to calculate time credits for inmates' good behavior. The software glitch led to a...

惠尔顿上网行为管理系统任意文件下载漏洞

No description provided by source...

惠尔顿上网行为管理系统命令执行漏洞

No description provided by source...

HackerOne: Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports

Hi Team, Legend ====== AppSecBounty = Bug ProgramSandbox Program Hacker1001 = Bug Reporter BugAdmin = Program Admin BugMember = Team Member associated ProgramManagement Group ProgramManagement Group = Custom Group created with "Program Management Permission" Steps: 1. Hacker1001 reports a Bug to...

CVE-2015-6766

Use-after-free vulnerability in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache...

WhatsApp Blocks Links to Telegram Messenger (Its biggest Competitor)

It seems like Facebook-owned popular messaging service WhatsApp is blocking links to rival messaging applications – at least Telegram app for now. Telegram users are noticing that WhatsApp is blocking any links to the privacy-oriented messaging service Telegram.me. Although users are free to send...

MGASA-2015-0460 Updated python-cryptography packages fix security vulnerability

The OpenSSL backend prior to 1.0.2 made extensive use of assertions to check response codes where our tests could not trigger a failure. However, when Python is run with -O these asserts are optimized away. If a user ran Python with this flag and got an invalid response code this could result in...

HackerOne: Pre-generation of 2FA secret/backup codes seems like an unnecessary risk

If you manage to get a malicious script running in HackerOne, requesting https://hackerone.com/settings/authentication/edit and parsing out the two factor authentication form will yield either… - the 2FA secret key and backup codes that will be used if 2FA is enabled for the first time this sessi...

Python 3.5 product_setstate() Out-Of-Bounds Read Vulnerability

Python versions 3.3 through 3.5 suffer from a vulnerability caused by the behavior of the productsetstate function. When called, the function loops over the state tuple provided and clamps each given index to a value within a range from 0 up to the max number of pools. Then, it loops over the poo...

USN-2766-1 spice vulnerabilities

Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtualization. CVE-2015-5260, CVE-2015-526...

Oracle: Security Advisory (ELSA-2015-3073)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Imgur: Content Sniffing not enabled

The HTTP header X-Content-Type-Options was not set to nosniff. This can cause some browsers to try to determine the content/encoding type of a response, which is an undesired behavior...

MALHEUR - Automatic Analysis of Malware Behavior

A novel tool for malware analysis Malheur is a tool for the automatic analysis of malware behavior program behavior recorded from malicious software in a sandbox environment. It has been designed to support the regular analysis of malicious software and the development of detection and defense...

Microsoft is Auto-Downloading Windows 10 to PCs, Even If You Don't Want it

Microsoft wholeheartedly wants you to upgrade to Windows 10. So much that even if you have not opted-in for Windows 10 upgrade, you will get it the other way. Surprised? If you have Windows Update enabled on your PCs running Windows 7 or Windows 8.1, you’ll notice a large file — between 3.5GB and...

Reminder! If You Haven't yet, Turn Off Windows 10 Keylogger Now

Do you know? Microsoft has the power to track every single word you type or say to its digital assistant Cortana while using its newest operating system, Windows 10. Last fall, we reported about a 'keylogger' that Microsoft openly put into its Windows 10 Technical Preview saying the company 'may...