This Week in Security News: Intel Says ‘Tiger Lake’ Will Drown Control-Flow Malware and New Phishing Campaign Targeting Office 365 Exploits Brand Names

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how the next generation of Intel mobile processors will include malware protection built into the chip. Also, read about a new...

Intel Adds Anti-Malware Protection in Tiger Lake CPUs

Intel’s upcoming class of mobile CPUs, code named “Tiger Lake,” will feature a long anticipated security layer, called Control-flow Enforcement Technology CET, which aims to protect against common malware attacks. CET protects against attacks on processors’ control flow, which refers to the order...

CVE-2020-8675

Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

CVE-2020-8675

Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2020-8675

The CVE-2020-8675 issue affects the Intel® Innovation Engine Build and Signing Tool prior to version 1.0.859. The root cause is insufficient control flow management in the firmware build and signing tool, which could let an unauthenticated user escalate privileges via physical access. Impact is e...

CVE-2020-0527

Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...

Stable Channel Update for Desktop

The stable channel has been updated to 81.0.4044.129 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

Rubo DICOM Viewer 2.0 - Buffer Overflow (SEH)

Exploit Title: Rubo DICOM Viewer 2.0 - Buffer Overflow SEH Exploit Author: bzyo Date: 2020-04-17 Vulnerable Software: Rubo Medical Imaging - DICOM Viewer 2.0 Vendor Homepage: http://www.rubomedical.com/ Version: 2.0 Software Link : http://www.rubomedical.com/download/index.php Tested Windows 7 SP...

CVE-2020-0577

Insufficient control flow for IntelR Modular Server MFS2600KISPP Compute Module may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

Buffer overflow

Insufficient control flow for IntelR Modular Server MFS2600KISPP Compute Module may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access...

CVE-2020-0577

Intel Modular Server MFS2600KI Compute Module is affected by CVE-2020-0577 due to insufficient control flow, allowing an unauthenticated user to potentially escalate privileges via adjacent access. The Intel advisory also covers CVE-2020-0576 and CVE-2020-0578 on the same module. The advisory sta...

PT-2020-5638

Name of the Vulnerable Software and Affected Versions Intel Modular Server MFS2600KISPP Compute Module affected versions not specified Intel Modular Server MFS2600KI affected versions not specified Description The issue is related to insufficient control flow and a buffer copy without input size...

MGASA-2020-0157 Updated dcraw packages fix security vulnerabilities

The updated packages fix security vulnerabilities: There is a floating point exception in the kodakradcloadraw function in dcrawcommon.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack. CVE-2017-13735 In LibRaw through 0.18.4, an out of bounds read flaw related to...

Updated dcraw packages fix security vulnerabilities

The updated packages fix security vulnerabilities: There is a floating point exception in the kodakradcloadraw function in dcrawcommon.cpp in LibRaw 0.18.2. It will lead to a remote denial of service attack. CVE-2017-13735 In LibRaw through 0.18.4, an out of bounds read flaw related to...

CVE-2020-3885: Always-Incorrect Control Flow Implementation

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A file URL may be incorrectly processed...

PT-2020-6139

Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.4 iPadOS versions prior to 13.4 macOS affected versions not specified tvOS versions prior to 13.4 Safari versions prior to 13.1 iTunes for Windows versions prior to 12.10.5 iCloud for Windows versions prior to 10.9.3 a...

CVE-2020-9425: Always-Incorrect Control Flow Implementation

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in...

CVE-2019-19324: Always-Incorrect Control Flow Implementation

Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted accidental JWT acceptance...