Rizin resource management error vulnerability

Rizin is a free open source reverse engineering framework from the Rizin organization. It is used for analyzing binary files, disassembling code, debugging programs, as a forensic tool, as a scriptable command-line hex editor capable of opening disk files, and more. Rizin suffers from a security...

Crypto Miners Using Tox P2P Messenger as Command and Control Server

Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method, marking a shift from its earlier role as a contact method for ransomware negotiations. The findings from Uptycs, which analyzed an Executable and Linkable Format ELF artifact "72client"...

DEBIAN-CVE-2020-27788

An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service...

UBUNTU-CVE-2020-27790

A floating point exception issue was discovered in UPX in PackLinuxElf64::invertptdynamic function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability...

UPX Buffer Error Vulnerability

UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 3.96, which stems from an out-of-bounds read access vulnerability found in the PackLinuxElf64::canPack function of the plxelf.cpp file, which could be triggered by an attacker using a...

UPX numerical error vulnerability

UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 3.96, which stems from a floating-point exception issue found in the PackLinuxElf64::invertptdynamic function of the plxelf.cpp file, which can be triggered by an attacker with a crafte...

UPX security vulnerabilities

UPX is a portable and extensible executable compression program. A security vulnerability exists in UPX version 3.96, which stems from a Segmentaation error found in the invertptdynamic function of plxelf.cpp, where an attacker utilizes a crafted input file to allow invalid access to a memory...

GNU Binutils Resource Management Vulnerability

GNU Binutils is a set of tools for working with binary files. A resource management error vulnerability exists in GNU Binutils, which stems from the function bfddwarf2findnearestlinewithalt in dwarf2.c containing an excessive memory consumption vulnerability that can be exploited by an attacker t...

binutils:fuzz_objcopy: Use-of-uninitialized-value in cache_bwrite

Detailed Report: https://oss-fuzz.com/testcase?key=5445795985358848 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjcopy Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cachebwrite bfdbwrite...

Newly Uncovered PyPI Package Drops Fileless Cryptominer to Linux Systems

A now-removed rogue package pushed to the official third-party software repository for Python has been found to deploy cryptominers on Linux systems. The module, named "secretslib" and downloaded 93 times prior to its deletion, was released to the Python Package Index PyPI on August 6, 2022 and i...

Manjusaka – Cybercriminal’s new attack framework weapon

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary Manjusaka is a new attack framework that mimics Cobalt Strike and Sliver. The new malware family implants are written in the Rust programming language and are compatible with Windows and Linux. The command and...

openSUSE: Security Advisory for dwarves (SUSE-SU-2022:2614-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2614-2 Security update for dwarves and elfutils

This update for dwarves and elfutils fixes the following issues: elfutils was updated to version 0.177 jscSLE-24501: - elfclassify: New tool to analyze ELF objects. - readelf: Print DWATdatamemberlocation as decimal offset. Decode DWATdiscrlist block attributes. - libdw: Add DWATGNUnumerator,...

binutils:fuzz_objdump: Heap-buffer-overflow in bfd_getl64

Detailed Report: https://oss-fuzz.com/testcase?key=6348955700559872 Project: binutils Fuzzing Engine: afl Fuzz Target: fuzzobjdump Job Type: aflasanbinutils Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000000f7 Crash State: bfdgetl64 bfdelf64swapdynin...

Unbreakable Enterprise kernel security update

4.14.35-2047.515.3 - uek-rpm: Enable Pensando EMMC reset controller Thomas Tai Orabug: 34325721 - mfd: pensandoelbasr: Add Pensando Elba System Resource Chip Brad Larson Orabug: 34325721 - dsc-drivers: update drivers for 1.15.9-C-65 Shannon Nelson Orabug: 34325721 4.14.35-2047.515.2 - net/rds:...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.515.3.el7 - uek-rpm: Enable Pensando EMMC reset controller Thomas Tai Orabug: 34325721 - mfd: pensandoelbasr: Add Pensando Elba System Resource Chip Brad Larson Orabug: 34325721 - dsc-drivers: update drivers for 1.15.9-C-65 Shannon Nelson Orabug: 34325721 4.14.35-2047.515.2.el7 -...

Linux kernel load_elf_binary ASLR bypass Info Disclosure

The vulnerability of the loadelfbinary function in the Linux operating system’s kernel arises due to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to bypass the ASLR protection mechanism and disclose the protected information...

GSD-2022-1003419 x86/kexec: fix memory leak of elf header buffer

x86/kexec: fix memory leak of elf header buffer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.46 by commit...

GSD-2022-1003162 x86/kexec: fix memory leak of elf header buffer

x86/kexec: fix memory leak of elf header buffer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.14 by commit...

GSD-2022-1002849 x86/kexec: fix memory leak of elf header buffer

x86/kexec: fix memory leak of elf header buffer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.3 by commit...