Spectre Will Haunt Us For a Long Time

During a recent Congressional hearing, Senators voiced concerns about the ongoing Spectre and Meltdown vulnerabilities. While the technical details were predictably glossed over, most of the hearing focused on Intel informing Chinese partners about the flaws six months before they went public...

CPU July 2018

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories...

Chrome Now Features Site Isolation to Defend Against Spectre

Google introduced new security mitigations for its Chrome browser to defend against recently discovered Spectre variants. The new security feature, called site isolation, essentially isolates different browser work processes between various browser tabs. That means one tab’s webpage rendering and...

Google Enables 'Site Isolation' Feature By Default For Chrome Desktop Users

Google has by default enabled a security feature called "Site Isolation" in its web browser with the release of Chrome 67 for all desktop users to help them protect against many online threats, including Spectre and Meltdown attack. Site Isolation is a feature of the Google Chrome web browser tha...

Google Enables 'Site Isolation' Feature By Default For Chrome Desktop Users

Google has by default enabled a security feature called "Site Isolation" in its web browser with the release of Chrome 67 for all desktop users to help them protect against many online threats, including Spectre and Meltdown attack. Site Isolation is a feature of the Google Chrome web browser tha...

Two New Spectre-Class CPU Flaws Discovered—Intel Pays $100K Bounty

Intel has paid out a $100,000 bug bounty for new processor vulnerabilities that are related to Spectre variant one CVE-2017-5753. The new Spectre-class variants are tracked as Spectre 1.1 CVE-2018-3693 and Spectre 1.2, of which Spectre 1.1 described as a bounds-check bypass store attack has been...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

WebAssembly Changes Could Ruin Meltdown/Spectre Browser Patches

Upcoming changes to the WebAssembly Wasm format may defang the browser patches for infamous side-channel attacks Meltdown and Spectre. Wasm was invented to improve execution speed for porting desktop applications to web-based environments; programs are compiled in Wasm and then can easily be run ...

OpenBSD Disables Intel Hyper-Threading to Prevent Spectre-Class Attacks

Security-oriented BSD operating system OpenBSD has decided to disable support for Intel's hyper-threading performance-boosting feature, citing security concerns over Spectre-style timing attacks. Introduced in 2002, Hyper-threading is Intel's implementation of Simultaneous Multi-Threading SMT tha...

Security Bulletin: IBM Cloud Private has released a patch in response to the vulnerabilities known as Spectre and Meltdown(CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754)

Summary On Wednesday, January 3, 2018, researchers announced a security vulnerability known as Spectre and Meltdown. These security vulnerabilities are being tracked across three security advisories: CVE-2017-5753, CVE-2017-5715, CVE-2017-5754. Additional details can be found at this link. IBM ha...

Security Bulletin: IBM PurePower Integrated Manager has released instructions in response to the vulnerabilities known as Spectre and Meltdown

Summary IBM has released the following instructions for IBM PurePower Integrated Manager in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. RHEL Server is shipped as a component of PPIM. Information about a security vulnerability affecting RHEL Server has been published in a Red Hat...

Security Bulletin: PowerKVM has released updates in response to the vulnerabilities known as Spectre and Meltdown.

Summary PowerKVM may be affected by vulnerabilities in the Linux kernel. IBM has now addressed these vulnerabilities. IBM has released the following updates for PowerKVM in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:1699-1) (Meltdown) (Spectre)

This update for xen fixes several issues. This feature was added : - Added support for qemu monitor command These security issues were fixed : - CVE-2018-3639: Prevent attackers with local user access from extracting information via a side-channel analysis, aka Speculative Store Bypass SSB, Varia...

Security Bulletin: IBM Spectrum Protect Plus has released instructions for obtaining an update in response to the vulnerabilities known as Spectre and Meltdown

Summary IBM has released the instructions in response to CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754. These vulnerabilities are known as Spectre and Meltdown. Vulnerability Details CVEID: CVE-2017-5715 CVEID: CVE-2017-5753 CVEID: CVE-2017-5754 Affected Products and Versions IBM Spectrum Prote...

Security Bulletin: IBM MessageSight V1.2 has released 1.2.0.3-IBM-IMA-IFIT24219 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following ifix for IBM MessageSight V1.2 in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions Affected IBM MessageSight | Affected Versions...

Security Bulletin: IBM StoredIQ has released Interim Fix 7.6.0.14-IBMStoredIQ_IF001 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following Interim Fix 7.6.0.14-IBMStoredIQIF001 for IBM StoredIQ in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions Affected Product Name |...

Security Bulletin: IBM StoredIQ for Legal has released Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 for IBM StoredIQ for Legal in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions Affected Product...

Security Bulletin: IBM Security Directory Suite has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following fixpack for IBM Security Directory Suite in response to CVE-2017-5753 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5754 Affected Products and Versions IBM Security Directory Suite ISDS 8.0.0, 8.0.1 Remediation/Fixes Product |...

Security Bulletin: IBM Security Identity Manager has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following fixpack for IBM Security Identity Manager in response to CVE-2017-5753 and CVE-2017-5754. Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5754 Affected Products and Versions IBM Security Identity Manager ISIM 7.0.0, 7.0.1 Remediation/Fixes Product...

Security Bulletin: IBM Security Guardium has released patch in response to the vulnerabilities known as Spectre and Meltdown

Summary IBM has released the following patch for IBM Security Guardium in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions IBM Security Guardium V8.2 IBM Security Guardium...