May 26, 2017—KB4023680 (OS Build 14393.1230)

None None...

Keybase Extension Brings End-to-End Encrypted Chat To Twitter, Reddit, GitHub

A recently released Chrome extension, developed by the public key crypto database Keybase, brought end-to-end encrypted messaging to several apps this week. Keybase, a service that allows users to identify themselves with a public encryption key, introduced its end-to-end encrypted chat feature...

Microsoft Malware Protection Engine Denial of Service Vulnerability

A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affecte...

Denial Of Service (DoS)

ImageMagick is vulnerable to denial of service DoS attacks. These attacks can be triggered by running a RLE image through coders/rle.c and leveraging a flaw in the end of file handling...

DEBIAN-CVE-2017-9144

In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c...

UBUNTU-CVE-2017-9144

In ImageMagick 7.0.5-5, a crafted RLE image can trigger a crash because of incorrect EOF handling in coders/rle.c...

FreeBSD : asterisk -- Memory exhaustion on short SCCP packets (fab87bff-3ce5-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with 'chanskinny' enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packe...

Google Chrome AnimationController::endAnimationUpdate memory misreference vulnerability

Google Chrome is a web browser developed by Google, Inc.AnimationController::endAnimationUpdate is one of the animation controllers. A memory misreference vulnerability exists in AnimationController::endAnimationUpdate in Google Chrome. An attacker can exploit this vulnerability to cause a denial...

Senate's Use of Signal A Good First Step, Experts Say

On Tuesday the United States Senate made it official and approved the use of encrypted messaging app Signal by staffers. Encryption advocates applauded the measure, but say more needs to be done to protect “civic” infrastructure critical to democracy. “The move to secure communications...

Fatal vulnerability will allow an attacker to bypass Apple's OTR signature verification and steal your iCloud keychain information-vulnerability warning-the black bar safety net

! Background content In the analysis of the iOS platform and sandbox escape about the attack surface when we in the iCloud keychain sync feature of OTR implementation has discovered a serious security vulnerability. iCloud keychain sync feature allows users in a secure manner across the device to...

Dutch Police Seize Another Company that Sells PGP-Encrypted Blackberry Phones

The Dutch police arrested four suspects on Tuesday on suspicion of money laundering and involvement in selling custom encrypted BlackBerry and Android smartphones to criminals. The Dutch National High Tech Crime Unit NHTCU, dedicated team within the Dutch National Police Agency aims to investigat...

Announcement: End-of-life Metasploit 32-bit versions

Rapid7 announced the end of life of Metasploit Pro 32-bit versions for both Windows and Linux operating systems on July 5th, 2017. This announcement applies to all editions: Metasploit Pro, Metasploit Express and Metasploit Community. After this date Metasploit 32-bit platforms will not receive...

IoT Security Testing Methodology

By Deral Heiland IoT - IoT Research Lead Rapid7 Nathan Sevier - Senior Consultant Rapid7 Chris Littlebury - Threat Assessment Manage Rapid7 End-to-end ecosystem methodology When examining IoT technology, the actionable testing focus and methodology is often applied solely to the embedded device...

Strengthening Network Access Security with Multi-Factor Authentication

As technology continues to develop, more and more applications become not just convenient, but necessary. It was less than a decade ago that it was inconceivable we would 'need' to carry a consumer device to access the internet in our pockets. Today, it is essential. The same is true with the...

Microsoft Windows 10 Version 1507 Unsupported Version Detection (deprecated)

This plugin has been replaced by Windows Security-End-of-Life plugins. C Tenable Network Security, Inc. @DEPRECATED@ Deprecated on 2024 Mar 14. Replaced by Windows SEoL plugins. include'compat.inc'; if description scriptid100064; scriptversion"1.10";...

DEBIAN-CVE-2017-7995

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the getuser function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL...

Threat Outbreak Alert RuleID28827: Email Messages Distributing Malicious Software on May 3, 2017

Medium Alert ID: 53680 First Published: 2017 May 3 15:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28827 may contain the following files: Name | Size ...

Null pointer dereference

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...

DEBIAN-CVE-2017-7895

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...

UBUNTU-CVE-2017-7895

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and...