Security Vulnerabilities fixed in Thunderbird 128.1 — Mozilla

Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape....

CVE-2024-7530: Use After Free

Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox 129...

CVE-2024-7528: Use After Free

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1...

Enhancing Incident Response Readiness with Wazuh

Incident response is a structured approach to managing and addressing security breaches or cyber-attacks. Security teams must overcome challenges such as timely detection, comprehensive data collection, and coordinated actions to enhance readiness. Improving these areas ensures a swift and...

IBM QRadar SIEM Disclosure of Protected Information

The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to the disclosure of protected information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Meta Settles for $1.4 Billion with Texas Over Illegal Biometric Data Collection

Meta, the parent company of Facebook, Instagram, and WhatsApp, agreed to a record $1.4 billion settlement with the U.S. state of Texas over allegations that it illegally collected biometric data of millions of users without their permission, marking one of the largest penalties levied by regulato...

Garbage collection and closures

Me, Surma, and Jason were hacking on a thing, and discovered that garbage collection within a function doesn't quite work how we expected. function demo const bigArrayBuffer = new ArrayBuffer100000000; const id = setTimeout = console.logbigArrayBuffer.byteLength; , 1000; return = clearTimeoutid;...

Garbage collection and closures

Me, Surma, and Jason were hacking on a thing, and discovered that garbage collection within a function doesn't quite work how we expected. function demo const bigArrayBuffer = new ArrayBuffer100000000; const id = setTimeout = console.logbigArrayBuffer.byteLength; , 1000; return = clearTimeoutid;...

CVE-2024-3113: Improper Neutralization of Input During Web Page Generation

The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

SIEM is not storage, with Jess Dodson (Lock and Code S05E16)

This week on the Lock and Code podcast… In the world of business cybersecurity, the powerful technology known as "Security Information and Event Management" is sometimes thwarted by the most unexpected actors—the very people setting it up. Security Information and Event Management—or SIEM—is a te...

US senators ask FTC to investigate car makers’ privacy practices

An ongoing US Senate investigation indicated that connected car makers violate consumer privacy by sharing and selling drivers’ data, including their location, on a vast scale, and that the same car makers often obtain consumer consent through deception. Based on this investigation, senators have...

How to collect XenServer Conversion Manager logs

Collect XenServer Conversion Manager logs for analysis...

PT-2024-40823 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A crash occurred due to a segmentation fault on an unknown address. The crash state included functions such as gs gc reclaim, ireclaim, and interp reclaim. Recommendations: At the momen...

kernel: nftables: nft_set_rbtree skip end interval element from gc

A flaw was found in the Linux kernel’s Netfilter subsystem. This issue occurs in the nftsetrbtree. rbtree lazy gc on insert, which might collect an end interval element just added in a transaction and skip the end interval elements not yet active...

kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

A flaw was found in the Linux kernel’s Netfilter nftables module. The issue arises from improper mutex handling during the garbage collection GC process. The problem occurs between the critical functions nftgcseqbegin and nftgcseqend, where a mutex lock is incorrectly released too early, leading ...

kernel: af_unix: Fix garbage collector racing against connect()

A flaw was found in the Linux kernel, where the management of inter-process communication uses AFUNIX sockets. The issue arises from a race condition where a partially initialized socket with specific permissions carrying SCMRIGHTS is improperly handled during garbage collection. This situation...

kernel: nftables: nft_set_rbtree skip end interval element from gc

A flaw was found in the Linux kernel’s Netfilter subsystem. This issue occurs in the nftsetrbtree. rbtree lazy gc on insert, which might collect an end interval element just added in a transaction and skip the end interval elements not yet active...

kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

A flaw was found in the Linux kernel’s Netfilter nftables module. The issue arises from improper mutex handling during the garbage collection GC process. The problem occurs between the critical functions nftgcseqbegin and nftgcseqend, where a mutex lock is incorrectly released too early, leading ...

kernel: af_unix: Fix garbage collector racing against connect()

A flaw was found in the Linux kernel, where the management of inter-process communication uses AFUNIX sockets. The issue arises from a race condition where a partially initialized socket with specific permissions carrying SCMRIGHTS is improperly handled during garbage collection. This situation...

This Machine Exposes Privacy Violations

A former Google engineer has built a search engine, webXray, that aims to find illicit online data collection and tracking—with the goal of becoming “the Henry Ford of tech lawsuits.”...