[SECURITY] Fedora 40 Update: mingw-orc-0.4.40-1.fc40

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic...

Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools

A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect. The vulnerability in question is CVE-2023-48788 CVSS score: 9.3, an SQL injection bu...

Malicious code in tools_platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cce108b444c9a36ad6acda9ea27bf9a2c4ebefee5acf9bec84477f93a1329b04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lazarus group evolves its infection chain with old and new malware

Over the past few years, the Lazarus group has been distributing its malicious software by exploiting fake job opportunities targeting employees in various industries, including defense, aerospace, cryptocurrency, and other global sectors. This attack campaign is called the DeathNote campaign and...

CISA Mandates Cloud Security for Federal Agencies by 2025 Under Binding Directive 25-01

The U.S. Cybersecurity and Infrastructure Security Agency CISA has issued Binding Operational Directive BOD 25-01, ordering federal civilian agencies to secure their cloud environments and abide by Secure Cloud Business Applications SCuBA secure configuration baselines. "Recent cybersecurity...

RLSA-2024:10289 Moderate: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents CVE-2021-33198 podman: podman machine spawns gvproxy...

container-tools:rhel8 security update

An update is available for podman, buildah, module.toolbox, module.podman, cockpit-podman, containers-common, module.criu, module.conmon, module.aardvark-dns, module.containers-common, module.python-podman, oci-seccomp-bpf-hook, module.fuse-overlayfs, module.oci-seccomp-bpf-hook, module.udica,...

[SECURITY] Fedora 41 Update: python-nbdime-4.0.2-2.fc41

Nbdime provides tools for diffing and merging of Jupyter notebooks. - nbdiff: compare notebooks in a terminal-friendly way - nbmerge: three-way merge of notebooks with automatic conflict resolution - nbdiff-web: shows you a rich rendered diff of notebooks - nbmerge-web: gives you a web-based...

[SECURITY] Fedora 40 Update: python-nbdime-4.0.2-2.fc40

Nbdime provides tools for diffing and merging of Jupyter notebooks. - nbdiff: compare notebooks in a terminal-friendly way - nbmerge: three-way merge of notebooks with automatic conflict resolution - nbdiff-web: shows you a rich rendered diff of notebooks - nbmerge-web: gives you a web-based...

RockyLinux 8 : container-tools:rhel8 (RLSA-2024:10289)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:10289 advisory. golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents CVE-2021-33198 podman: podman machine...

The vulnerability of Siemens Solid Edge’s design and simulation tools, related to a countable loss of significance, allows attackers to execute arbitrary code.

The vulnerability of Siemens Solid Edge’s design and simulation tools is related to a countable amount of significance loss during the processing of PAR format files. Exploiting this vulnerability can allow attackers to execute arbitrary code...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: filebrowser, crossplane-provider-sql, docker, terraform-provider-pagerduty, flux, terraform-provider-aws, mailpit, opa, memcached-exporter, wal-g, cue, go-licenses, glab, addon-resizer, kots, harbor-registry, kube-bench, pulumi, vertical-pod-autoscaler,...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: falco-exporter, fluent-operator, helm, tflint, secrets-store-csi-driver-fips, dynamic-localpv-provisioner, crossplane-provider-aws, bom, openbao-fips, crossplane, amazon-k8s-cni-fips, istio-pilot-discovery, neuvector-scanner, temporal-ui-server, rqlite,...

CVE-2024-45338 vulnerabilities

Vulnerabilities for packages: filebrowser, crossplane-provider-sql, docker, terraform-provider-pagerduty, flux, terraform-provider-aws, mailpit, opa, memcached-exporter, wal-g, cue, go-licenses, glab, addon-resizer, kots, harbor-registry, kube-bench, pulumi, vertical-pod-autoscaler,...

AZL-54461 CVE-2024-45338 affecting package cri-tools for versions less than 1.32.0-1

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54512 CVE-2024-45338 affecting package cri-tools for versions less than 1.29.0-6

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

HubPhish Abuses HubSpot Tools to Target 20,000 European Users for Credential Theft

Cybersecurity researchers have disclosed a new phishing campaign that has targeted European companies with an aim to harvest account credentials and take control of the victims' Microsoft Azure cloud infrastructure. The campaign has been codenamed HubPhish by Palo Alto Networks Unit 42 owing to t...

CISA Issues BOD 25-01, Implementing Secure Practices for Cloud Services

Today, CISA issued Binding Operational Directive BOD 25-01, Implementing Secure Practices for Cloud Services to safeguard federal information and information systems. This Directive requires federal civilian agencies to identify specific cloud tenants, implement assessment tools, and align cloud...

Advisory ROSA-SA-2024-2542

Software: vorbis-tools 1.4.2 OS: ROSA-CHROME packageevrstring: vorbis-tools-1.4.2-3 CVE-ID: CVE-2023-43361 BDU-ID: 2024-02625 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Vorbis-tools package is related to the ability to write beyond buffer boundaries in memory when converting wav files to og...

This Week in Spring - December 17th, 2024

This Week in Spring - December 17th, 2024 Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! It's the 17th of December, 2024! And you know what means? The end of the year is nearly upon us! I can't believe it. It's been a very long year indeed, but I'm happy to get on board a...