PYSEC-2018-131

Exiv2 0.26 has integer overflows in LoaderTiff::getData in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp...

Why bad coding habits die hard—and 7 ways to kill them

Developers are usually the focus of blame when software vulnerabilities cause organizational breaches. Sometimes, quality assurance engineers are included in the flame. Interestingly, though, hardly anyone looks at why bad coding habits form in the first place. We're talking about the culture, th...

Multiple Buffer Overflow Vulnerabilities in Eaton ELCSoft Programming Software

Eaton ELCSoft Programming Software is a suite of software for configuring programmable logic controllers. Multiple buffer overflow vulnerabilities exist in Eaton ELCSoft Programming Software, which stem from a failure to perform sufficient boundary checks before copying user data into an undersiz...

SUSE-SU-2018:0811-1 Security update for wireshark

This update for wireshark fixes the following issues: Security issue fixed bsc1082692: - CVE-2018-7335: The IEEE 802.11 dissector could crash wnpa-sec-2018-05 - CVE-2018-7321: thrift long dissector loop dissectthriftmap - CVE-2018-7322: DICOM: inifinite loop dissectdcmtag - CVE-2018-7323: WCCP:...

Reported Critical Vulnerabilities In Microsoft Software On the Rise

The number of reported vulnerabilities in Microsoft software has mounted from 325 in 2013 to 685 last year, a rise of 111 percent, according to new research. Moreover, there has also been a 54 percent increase in critical Microsoft vulnerabilities since 2016, researchers at Avecto said in their...

SUSE-SU-2018:0129-1 Security update for mercurial

This update for mercurial fixes the following issues: - CVE-2017-17458: In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of...

OPENSUSE-SU-2018:0057-1 Security update for irssi

This update for irssi to version 1.0.6 fixes several issues that may affect the stability of irssi: - CVE-2018-5205: Data access beyond the end of the string when using incomplete escape codes - CVE-2018-5206: NULL pointer dereference when the channel topic is set without specifying a sender -...

Fast Followers Boost - Corrupted files, Exported components, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Fast Followers Boost published at the 'play' market has multiple vulnerabilities...

CVE-2017-12344

Multiple vulnerabilities in Cisco Data Center Network Manager DCNM Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting...

CVE-2017-16899

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the readtextobject functions in read.c and read13.c...

MGASA-2017-0349 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 3.3.4, which fixes several security vulnerabilities and other bugs which were corrected upstream...

Proof It's Possible to Hack German Elections; Hackers Tamper with Voting-Software

Germany's democracy is in danger, as the upcoming federal elections in the country, where nearly 61.5 million citizens are going to vote on September 24th, could be hijacked. Hackers have disclosed how to hack the German voting software to tamper with votes and alter the outcome of an election...

MGASA-2017-0295 Updated avidemux packages fix security vulnerabilities

The avidemux package has been updated to version 2.7.0. Avidemux includes a bundled copy of the ffmpeg libraries, which have been updated from version 3.0.7 to version 3.3.3, fixing several security issues and other bugs...

SUSE-SU-2017:2090-1 Security update for Linux Kernel Live Patch 16 for SLE 12 SP1

This update for the Linux Kernel 3.12.74-606445 fixes several issues. The following security bugs were fixed: - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-9242: The ip6appenddata function in net/ipv6/ip6output.c in the Linux kernel is too...

Internet Speed Meter Lite - Exported components, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Internet Speed Meter Lite published at the 'play' market has multiple vulnerabilities...

Legislation Proposed to Secure Connected IoT Devices

A Senate bill introduced today would prioritize security in connected devices, requiring providers who sell to the U.S. government to implement measures that would have been an impediment to the IoT botnet-fueled attacks against DNS provider Dyn and webhost OVH. The Internet of Things Cybersecuri...

Measuring Vulnerability Rediscovery

New paper: "Taking Stock: Estimating Vulnerability Rediscovery," by Trey Herr, Bruce Schneier, and Christopher Morris: Abstract: How often do multiple, independent, parties discover the same vulnerability? There are ample models of vulnerability discovery, but little academic work on this issue o...

Ethereum Hacks

The press is reporting a $32M theft of the cryptocurrency Ethereum. Like all such thefts, they're not a result of a cryptographic failure in the currencies, but instead a software vulnerability in the software surrounding the currency -- in this case, digital wallets. This is the second Ethereum...

Balance. Финансовое равновесие - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Balance. Финансовое равновесие published at the 'play' market has multiple vulnerabilities...

Subaru car software vulnerability analysis—never a failure of token-vulnerability warning-the black bar safety net

Not long ago, one from California car, information security researcher Aaron Guzman, in Australia, held a computer security conference to introduce a black into the Subaru car of the method. In his own 2017 Subaru WRX STI was found in a surprising number of software vulnerabilities, through these...