Windows Privilege Escalation

The vulnerability of the Windows operating system’s kernel relates to incorrect access control. Exploiting this vulnerability allows a local attacker to manipulate processes, simulate communication between them, or cause service failures through a specially crafted application...

Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY)

Mandiant has observed APT29 using a stealthy backdoor that we call POSHSPY. POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation WMI. In the investigations Mandiant has conducted, it appeared that APT29 deployed POSHSPY as a secondary...

Cisco NX-OS Unauthorized Process

The vulnerability of the Telnet function in the Cisco NX-OS network operating system, which is used in Cisco Nexus 9000 Series switches, arises from operations that go beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to initiate unauthorized system access,...

Cisco NX-OS Unauthorized Process

The vulnerability of the remote input function in the network operating system of Cisco NX-OS, which operates on Cisco Nexus 9000 Series switches, arises due to operations that go beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to initiate unauthorized input...

coreutils security and bug fix update

8.4-46.0.1 - clean up empty file if cp is failed Orabug 15973168 8.4-46 - pure rebuild to bring back support for aclextendedfilenofollow on x8664 8.4-45 - su: deny killing other processes with root privileges CVE-2017-2616 8.4-44 - fix the functionality of 'sort -h -k ...' in multi-byte locales...

CVE-2017-6507

An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due ...

CVE-2017-6186

Code injection vulnerability in Bitdefender Total Security 12.0 and earlier, Internet Security 12.0 and earlier, and Antivirus Plus 12.0 and earlier allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Bitdefender process via a...

CVE-2017-5567

Code injection vulnerability in Avast Premier 12.3 and earlier, Internet Security 12.3 and earlier, Pro Antivirus 12.3 and earlier, and Free Antivirus 12.3 and earlier allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any Avast process...

[SECURITY] Fedora 25 Update: qemu-2.7.1-4.fc25

QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...

Android Code Execution

The vulnerability of the libgdx library in the Android operating system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of an unprivileged process, using a specially crafted file. This issue is considered “high”...

Android Code Execution

The vulnerability of the Qualcomm Android operating system’s camera driver is related to deficiencies in access control. Exploiting this vulnerability allows a remote attacker to execute arbitrary malicious code within the kernel context. This issue is considered “high” because it requires...

CVE-2016-8012

CVE-2016-8012 affects Intel Security Data Loss Prevention Endpoint (DLPe) versions 9.4.200 and 9.3.600. The issue is an access-control vulnerability allowing authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes by manipulating pages in the target proces...

SAP Patches Critical HANA Vulnerability That Allowed Full Access

SAP patched a series of critical vulnerabilities in its cloud-based business platform HANA today that if exploited, could allow for a full system compromise without authentication. When chained together the flaws could lead to the theft of confidential information, financial fraud, and the...

March 2017 security update release

Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to turn on automatic updates. More information about this month’s security updates can be found on the Security Update Guide. Security bulletins were also...

PT-2017-1626

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Description The issue is related to the kernel API in Microsoft Windows, which does not properly enforce permissions. This can be exploited by a local attacker to spoof processes, imitate...

UBUNTU-CVE-2017-0476

A remote code execution vulnerability in AOSP Messaging could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as High due to the possibility of remote code execution within the context of an unprivileged...

Updated util-linux packages fix security vulnerability

With the su command from util-linux before 2.29.2, it is possible for any local user to send SIGKILL to other processes with root privileges. To exploit this, the user must be able to perform su with a successful login. SIGKILL can only be sent to processes which were executed after the su proces...

PT-2017-15451

Name of the Vulnerable Software and Affected Versions util-linux versions prior to 2.32.1 Description A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific...

Android Code Execution

The vulnerability of the Android operating system’s networking subsystem is related to access control deficiencies. Exploiting this vulnerability allows a remote attacker to execute arbitrary code of a local malicious application within the kernel context. This issue is considered “moderate,” as ...

Android Code Execution

The vulnerability of Synaptics’ sensor screen driver in the Android operating system is related to access control deficiencies. Exploiting this vulnerability allows a remote attacker to execute arbitrary local malware code within the kernel context. This issue is considered “highly critical”...