Intel® Wireless Bluetooth® and Killer™ Bluetooth® February 2022 Security Updates

Intel has informed HP of potential security vulnerabilities identified in some Intel® Wireless Bluetooth® and Killer™ Bluetooth® products which may allow denial of service. Intel is releasing software and firmware updates to mitigate these potential vulnerabilities. Intel has released updates to...

HP Workstation BIOS February 2022 Security Update

A potential security vulnerability has been identified in certain HP Workstation BIOS UEFI firmware which may allow arbitrary code execution. HP is releasing firmware mitigations for the potential vulnerability. HP has identified affected platforms and corresponding SoftPaqs with minimum versions...

CVE-2022-22566

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device...

CVE-2022-22567

Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware...

[SECURITY] Fedora 34 Update: rust-python-launcher-1.0.0-4.fc34

The Python Launcher for Unix. Launch your Python interpreter the lazy/smart way! This launcher is an implementation of the py command for Unix-based platforms. The goal is to have py become the cross-platform command that Python users typically use to launch an interpreter while doing development...

$320 milllion stolen from Wormhole crypto-trading platform

By using an exploit in the software of crypto-trading platform Wormhole, threat actors have stolen an estimated $322 million in cryptocurrencies. The platform is offering a $10 million award for the stolen money and details about the attack. How they pulled it off Wormhole Portal is a web-based...

The evolution of a Mac trojan: UpdateAgent’s progression

Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family—and depicts the rising complexity of threats across platforms. The trojan, tracked as UpdateAgent, started as a relatively basic information-stealer but was observed distributing...

HP UEFI Firmware February 2022 Security Updates

Potential vulnerabilities have been identified in UEFI firmware BIOS for some PC products which may allow escalation of privilege and arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities. HP has identified affected platforms and corresponding...

Living Off the Land: How to Defend Against Malicious Use of Legitimate Utilities

Living-off-the-land binaries LOLBins are no joke: Cyberattackers have been increasingly making use of them to hide their malicious work from security solutions. It’s time for threat hunters and IT security staff to familiarize themselves with how these are used in the attack chains of some of the...

CVE-2022-23597

Element Desktop before 1.9.7 is vulnerable to a remote code execution bug via user interaction that requires a malicious link click followed by another button click. The attacker can specify a binary path on the victim’s machine for execution (arguments cannot be set), and in some configurations ...

The vulnerability of the ImageIO component in iOS, iPadOS, tvOS, watchOS, and macOS allows attackers to gain access to confidential information.

The vulnerability of the ImageIO component in iOS, iPadOS, tvOS, watchOS, and macOS relates to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to access confidential information using a specially created malicious ASTC file...

The vulnerability of the Launch Services service for iOS, iPadOS, tvOS, watchOS, and macOS allows a hacker to escape from the isolated software environment.

The vulnerability of the Launch Services service for iOS, iPadOS, tvOS, watchOS, and macOS is related to security configuration errors. Exploiting this vulnerability can allow a perpetrator to escape from a isolated software environment...

The vulnerability of the ImageIO component in iOS, iPadOS, tvOS, watchOS, and macOS allows attackers to gain access to confidential information.

The vulnerability of the ImageIO component in iOS, iPadOS, tvOS, watchOS, and macOS relates to the ability to read data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to access confidential information...

Fedora: Security Advisory for rust-python-launcher (FEDORA-2022-c4071e3dc7)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL 1.0.2 < 1.0.2zc-dev Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zc-dev. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zc-dev advisory. - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of...

CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

UBUNTU-CVE-2021-4160

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis...

Polkit pkexec privilege elevation

Added: 01/27/2022 CVE: CVE-2021-4034 Background Polkit is a Linux package for handling policies that allow unprivileged processes to communicate with privileged processes. It includes a tool called pkexec that allows the user to execute commands as another user according to the polkit policy...

UBUNTU-CVE-2021-30952

An integer overflow was addressed with improved input validation. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution...