Black Hat 2019: Security's Powerful Cultural Transformation

LAS VEGAS — “Start with yes.'” That’s the advice to security teams from Dino Dai Zovi, mobile security lead at Square, giving the keynote on Wednesday at the 23rd annual Black Hat conference in Las Vegas. Taking as a first principle the idea that security teams now have the ear of company boards...

Arbitrary Code Execution

bash is vulnerable to arbitrary code execution. The vulnerability exists in the readtokenword function where deeply nested for loops can cause arbitrary code execution...

Denial of Service

Overview Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely. Recommendation Upgrade to version 2.0.0 or later. References GitHub Advisory...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-772)

This update for MozillaThunderbird fixes the following issues : Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues bsc1112852 : Security issues fixed MFSA 2018-28 : - CVE-2018-12389: Fixed memory safety bugs. - CVE-2018-12390: Fixed memory safety bugs. - CVE-2018-12391:...

Code injection

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...

DEBIAN-CVE-2018-12392

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...

Critical: thunderbird

Issue Overview: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 CVE-2018-12390 Crash with nested event loops CVE-2018-12392 Memory safety bugs fixed in Firefox ESR 60.3 CVE-2018-12389 Integer overflow during Unicode conversion while loading JavaScript CVE-2018-12393 Affected Packages:...

Fedora 29 : python-paramiko (2018-ea6b328afd)

Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in paramiko/authhandler.py. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client such as ansible are not...

Fedora 28 : python-paramiko (2018-3ff1cb628b)

Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in paramiko/authhandler.py. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client such as ansible are not...

SUSE SLED15 / SLES15 Security Update : libopenmpt (SUSE-SU-2018:1951-1)

This update for libopenmpt to version 0.3.9 fixes the following issues: These security issues were fixed : - CVE-2018-11710: Prevent write near address 0 in out-of-memory situations when reading AMS files bsc1095644 - CVE-2018-10017: Preven out-of-bounds memory read with IT/ITP/MO3 files containi...

The vulnerability of the RubyGems package management system, related to the creation of infinite loops, allows for the execution of arbitrary code.

The vulnerability of the RubyGems package management system is related to improper handling of the tar archive header, which can lead to the creation of an infinite loop. Exploiting this vulnerability allows a remote attacker to cause a service failure...

Debian DLA-1607-1 : samba security update

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2018-14629 Florian Stuelpner discovered that Samba is vulnerable to infinite query recursion caused by...

SUSE-SU-2018:4066-1 Security update for samba

This update for samba fixes the following issues: Update to samba version 4.7.11. Security issues fixed: - CVE-2018-14629: Fixed CNAME loops in Samba AD DC DNS server bsc1116319. - CVE-2018-16841: Fixed segfault on PKINIT when mis-matching principal bsc1116320. - CVE-2018-16851: Fixed NULL pointe...

RHEL 7 : thunderbird (RHSA-2018:3532)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3532 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.3.0. Security Fixes: Mozilla:...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Mozilla: Crash with nested event loops

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...

Mozilla: Crash with nested event loops

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...

openSUSE Security Update : MozillaThunderbird (openSUSE-2018-1340)

This update for MozillaThunderbird fixes the following issues : Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues bsc1112852 : Security issues fixed MFSA 2018-28 : - CVE-2018-12389: Fixed memory safety bugs. - CVE-2018-12390: Fixed memory safety bugs. - CVE-2018-12391:...

Mozilla: Crash with nested event loops

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...

Mozilla: Crash with nested event loops

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3...