Gentoo Security Advisory GLSA 201404-03

Gentoo Linux Local Security Checks GLSA 201404-03 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Apple iOS unprotected multipeer data leakage vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in the Apple iOS convenience initializer processing that allows the encryption level to be reduced to a non-encrypted session, resulting in the disclosure of sensitive data...

kernel security, bug fix, and enhancement update

2.6.32-573 - security selinux: dont waste ebitmap space when importing NetLabel categories Paul Moore 1130197 - x86 Revert Add driver auto probing for x86 features v4 Prarit Bhargava 1231280 - net bridge: netfilter: dont call iptables on vlan packets if sysctl is off Florian Westphal 1236551 - ne...

Bug in OpenSSH Opens Linux Machines to Password Cracking Attack

A simple but highly critical vulnerability recently disclosed in the most widely used OpenSSH software allows attackers to try thousands of password login attempts per connection in a short period. OpenSSH is the most popular software widely used for secure remote access to Linux-based systems...

Linux ASLR mmap weakness: Reducing entropy by half

A bug in Linux ASLR implementation has been found. The issue is that the mmap base address for processes is not properly randomized on some architectures due to an improper bit-mask manipulation. Affected systems have reduced the mmap area entropy of the processes by half. The number of possible...

Fedora 20 : nx-libs-3.5.0.29-1.fc20 (2015-3964)

Update to 3.5.0.29 : - further reduction of code size by Mike Gabriel - /.x2go/config/keystrokes.cfg, /etc/x2go/keystrokes.cfg and /etc/nxagent/keystrokes.cfg are now respected thanks to Horst Schirmeier - security fixes for CVE-2011-2895, CVE-2011-4028, CVE-2013-4396, CVE-2013-6462, CVE-2014-020...

Fedora 21 : nx-libs-3.5.0.29-1.fc21 (2015-3948)

Update to 3.5.0.29 : - further reduction of code size by Mike Gabriel - /.x2go/config/keystrokes.cfg, /etc/x2go/keystrokes.cfg and /etc/nxagent/keystrokes.cfg are now respected thanks to Horst Schirmeier - security fixes for CVE-2011-2895, CVE-2011-4028, CVE-2013-4396, CVE-2013-6462, CVE-2014-020...

Fedora 22 : nx-libs-3.5.0.29-1.fc22 (2015-3953)

Update to 3.5.0.29 : - further reduction of code size by Mike Gabriel - /.x2go/config/keystrokes.cfg, /etc/x2go/keystrokes.cfg and /etc/nxagent/keystrokes.cfg are now respected thanks to Horst Schirmeier - security fixes for CVE-2011-2895, CVE-2011-4028, CVE-2013-4396, CVE-2013-6462, CVE-2014-020...

Microsoft Publishes Information Sharing Framework

Microsoft earlier this week published a 25-page framework offering guidance on how to effectively share information and what kinds of information need to be shared in order to reduce overall risk. Information sharing has been an oft-repeated refrain in security and policy-making circles for the...

Apple Releases iOS 8.1.3

Apple has rolled out iOS 8.1.3 for iPhone, iPod touch and iPad devices, after weeks of extensive testing. The iOS 8.1.3 update contains bug fixes, stability enhancements and performance improvements. Among the new features, it reduces the amount of storage space required to perform a software...

DAMM - Differential Analysis of Malware in Memory

An open source memory analysis tool built on top of Volatility. It is meant as a proving ground for interesting new techniques to be made available to the community. These techniques are an attempt to speed up the investigation process through data reduction and codifying some expert knowledge...

Attackers Exploiting Windows OLE Vulnerability

Attackers are using a zero day vulnerability in nearly all supported versions of Windows in a series of targeted attacks. The flaw is in the OLE technology in Windows and can be used for remote code execution is a targeted user opens a rigged Office file. Microsoft is warning customers that there...

[SECURITY] [DSA 3026-1] dbus security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3026-1 [email protected] http://www.debian.org/security/ Florian Weimer September 16, 2014 http://www.debian.org/security/faq -...

unbreakable enterprise kernel security bug fix update

2.6.39-400.215.10 - auditsc: auditkrule mask accesses need bounds checking Andy Lutomirski Orabug: 19590597 CVE-2014-3917 2.6.39-400.215.9 - oracleasm: Add support for new error return codes from block/SCSI Martin K. Petersen Orabug: 18438934 2.6.39-400.215.8 - ibipoib: CSUM support in connected...

Verizon to Bolster Authentication with QR Codes

If you want to know what the future holds for authentication on the web, it all depends whom you ask. Some say it’ll come in the form of biometrics – iris and fingerprint scans, etc. Others say the answer lies in a tangle of constantly changing two-factor verification codes users need to punch in...

Microsoft Releases EMET 5.0 Exploit Mitigation Tool

The latest version of Microsoft’s freely available stopgap against zero-day exploits was released today with two new exploit mitigations and a batch of new configuration options. The update to Microsoft’s Enhanced Mitigation Experience Tool kit, or EMET, comes six months after a technical preview...

openSUSE Security Update : optipng (openSUSE-SU-2012:1329-1)

optipng received a fix for a palette reduction use-after-free vulnerability. CVE-2012-4432 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-699. The text description of this plugi...

Argus v3.0.6 - Real Time Auditing Network Activity

Argus is a fixed-model Real Time Flow Monitor designed to track and report on the status and performance of all network transactions seen in a data network traffic stream. Argus provides a common data format for reporting flow metrics such as connectivity, capacity, demand, loss, delay, and jitte...

OptiPNG: User-assisted execution of arbitrary code

Background OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. Description A use-after-free vulnerability exists in the palette reduction functionality of OptiPNG. Impact A remote attacker could entice a user to open a specially crafted imag...

Fedora 19 : subversion-1.7.16-1.fc19 (2014-3567)

This update includes the latest stable release of Apache Subversion 1.7, fixing a security issue CVE-2014-0032 : Subversion's moddavsvn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and...