CVE-2017-8392

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the bfddwarf2findnearestline function. This vulnerability causes programs that conduct an analysis...

CVE-2017-8398

Technical details for CVE-2017-8398 are not publicly provided in the supplied documents. The materials mention Binutils 2.28 but do not specify affected products/versions beyond that, root cause, impact, or fixes; monitor for updates.

CVE-2017-8398

dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash...

CVE-2017-8395

The Binary File Descriptor BFD library aka libbfd, as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc return-value check to see if memory had actually been allocated in the bfdgenericgetsectioncontents function. This vulnerability causes...

[SECURITY] Fedora 26 Update: community-mysql-5.7.18-2.fc26

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files...

The Time Has Arrived to Embrace Hackers

BOSTON—More than ever, hackers are getting a welcoming embrace from law enforcement, governments and business. Bug bounties and vulnerability disclosure programs are becoming the norm across industry, and hackers are no longer universally viewed as a pariah. Simultaneously, however, groups such a...

The vulnerability of the Microsoft Outlook email client, which allows a hacker to compromise the confidentiality of information.

The vulnerability of the Microsoft Outlook email client is related to lack of access control. Exploiting this vulnerability allows a malicious actor to bypass the security measures of office programs by using a specially created document...

Machine learning and the fight against ransomware

Ransomware is now everywhere. The number of emails containing ransomware rose 6,000 percent since 2015, and in 2016, 40 percent of all spam emails had one of these malicious programs hidden within, according to IBM. Other reports highlight the sophistication of ransomware nowadays and it's...

DEBIAN-CVE-2017-8284

The disasinsn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated...

Advances in Ad Blocking

Ad blockers represent the largest consumer boycott in human history. They're also an arms race between the blockers and the blocker blockers. This article discusses a new ad-blocking technology that represents another advance in this arms race. I don't think it will "put an end to the ad-blocking...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

UBUNTU-CVE-2015-4646

1 unsquash-1.c, 2 unsquash-2.c, 3 unsquash-3.c, and 4 unsquash-4.c in Squashfs and sasquatch allow remote attackers to cause a denial of service application crash via a crafted input...

PT-2017-10802 · Apple +1 · Darwin +1

Name of the Vulnerable Software and Affected Versions: Darwin affected versions not specified Description: The issue concerns the handling of root certificates on Darwin systems. Specifically, if a user has a root certificate loaded in their Keychain that is explicitly marked as not trusted, Go...

Using the memory corruption vulnerability in the Python sandbox escape-vulnerability warning-the black bar safety net

Simply skip the text the author's README, we directly enter into the technical details. The Python environment using a custom whitelist/blacklist programs to prevent access to dangerous built-in functions, modules, functions, etc. Based on theoperating systemthe isolation provides some additional...

Microsoft Edge browser vulnerability, allowing a hacker to execute arbitrary code

The vulnerability of Microsoft Edge arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to cause memory corruption in such a way that they can execute arbitrary code within the context of the current user. A successful...

bash: Specially crafted SHELLOPTS+PS4 variables allows command substitution

An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

Multiple cross-site request forgery CSRF vulnerabilities on the D-Link DI-524 Wireless Router with firmware 9.01 allow remote attackers to 1 change the admin password, 2 reboot the device, or 3 possibly have unspecified other impact via crafted requests to CGI programs...

CVE-2017-5633

CVE-2017-5633 describes multiple CSRF vulnerabilities affecting the D-Link DI-524 Wireless Router running firmware 9.01. The issue enables remote attackers to perform actions via crafted requests to CGI programs, including changing the admin password and rebooting the device (and possibly other i...