APPLE-SA-2013-09-12-2 Safari 5.1.10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-12-2 Safari 5.1.10 Safari 5.1.10 is now available and addresses the following: JavaScriptCore Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Visiting a maliciously crafted website may lead to an unexpected applicatio...

[Firefox] убираем кодирование кавычек в URL | Firefox URL quote encoding patch

See next post for English description! Патч призван устранить кодирование кавычек ',", в HTTP запросах. Начиная с версии 3.0 коммит, Firefox стал урл-кодировать одинарную кавычку ' в %27. Данное поведение нередко может помешать обнаружить SQL инъекцию в веб-приложениях, например, при участии...

Opera Cross-Site Scripting (XSS) Vulnerability - Mac OS X

Opera is prone to XSS attack. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:opera:operabrowser"; ifdescription...

Mac OS X : Cisco AnyConnect Secure Mobility Client 3.0.x / 3.1.x Local Privilege Escalation

The remote host has a version of Cisco AnyConnect 3.0.x or 3.1.x. As such, it is vulnerable to a local privilege escalation attack caused by improper permissions on a library directory. This issue could allow a local attacker to execute arbitrary programs with elevated privileges. C Tenable Netwo...

Adobe AIR for Mac <= 3.7.0.2100 Multiple Vulnerabilities (APSB13-17)

According to its version, the instance of Adobe AIR on the remote Mac OS X host is 3.7.0.2100 or earlier. It is, therefore, potentially affected by multiple vulnerabilities : - A heap-based buffer overflow vulnerability exists that could lead to code execution. CVE-2013-3344 - A memory corruption...

Chinese APT Espionage campaign, dubbed 'Icefog' targeted Military contractors and Governments

Kaspersky Lab has identified another Chinese APT campaign, dubbed 'Icefog', who targeted Governmental institutions, Military contractors, maritime / shipbuilding groups, telecom operators, industrial and high technology companies and mass media. The Hacking group behind the attack who carry out...

Wireshark Denial of Service Vulnerability (Sep 2013) - Mac OS X

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

Wireshark Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

Mailbox App for iOS Automatically Executes Javascript

UPDATE – The popular Mailbox app for iOS suffers from a bit of a security nightmare. A security researcher in Italy recently discovered that the app automatically executes javascript contained in any HTML email. “It is just a bad design choice,” said researcher Michele Spagnulo, a computer...

New Mac OS Malware exploited two known Java vulnerabilities

A new Mac OS Malware has been discovered called OSX/Leverage.A, which appears to be yet another targeted command-and-control Trojan horse, that creates a backdoor on an affected user's machine. The Trojan named 'Leverage' because the Trojan horse is distributed as an application disguised as a...

New Mac OS Malware exploited two known Java vulnerabilities

A new Mac OS Malware has been discovered called OSX/Leverage.A, which appears to be yet another targeted command-and-control Trojan horse, that creates a backdoor on an affected user’s machine. The Trojan named 'Leverage' because the Trojan horse is distributed as an application disguised as a...

Apple Xcode < 5.0 (Mac OS X)

The remote Mac OS X host has Apple Xcode prior to 5.0 installed. It, therefore, includes a version of git in which the imap-send command reportedly does not verify that a server hostname matches the domain name in its X.509 certificate. A man-in-the-middle attacker could leverage this vulnerabili...

Mozilla Thunderbird ESR Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Firefox Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Information Disclosure Vulnerability - Mac OS X

Mozilla Firefox is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SeaMonkey Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

SeaMonkey is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey"; ifdescription...

Mozilla Thunderbird Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Firefox ESR Multiple Vulnerabilities-01 (Sep 2013) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

CVE-2013-1130

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...

Design/Logic Flaw

Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619...