Why you can’t update it all at once?

It’s the second part of our talk with Daniil Svetlov at his radio show “Safe Environment” recorded 29.03.2017. In this part we talk about vulnerabilities in Linux and proprietary software, problems of patch an vulnerability management, and mention some related compliance requirements. Video with...

The vulnerability in the Firefox ESR software allows a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the maintenanceinstaller.exe installer of Mozilla Firefox ESR allows local users to elevate their privileges by placing a Trojan DLL file in the temporary folder during the update process...

The vulnerability of the Firefox browser allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the maintenanceinstaller.exe installer for Mozilla Firefox allows local users to elevate their privileges by placing a Trojan DLL file in the temporary folder during the update process...

CVE-2016-0349: Improper Access Control

IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call...

All Drupal Versions Open to Code Execution, Credential Theft Vulnerabilities

A number of issues exist in the content management system Drupal that could lead to code execution and the theft of database credentials via a man-in-the-middle attack, a researcher warns. The vulnerabilities lie in the way Drupal processes updates, according to Fernando Arnaboldi, senior securit...

Oracle Java FTC Settlement

Oracle’s stewardship of Java has been scrutinized by the security community, which in 2013 languished through nearly a full year of targeted attacks exploiting zero days and other vulnerabilities in the platform. Since then, Oracle has improved the Java user experience by denying unsigned applets...

CVE-2014-1520

maintenserviceinstaller.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process...

CVE-2014-1520

maintenserviceinstaller.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process...

Privilege escalation through Mozilla Maintenance Service Installer — Mozilla

Security researcher Ash reported an issue affected the Mozilla Maintenance Service on Windows systems. The Mozilla Maintenance Service installer writes to a temporary directory created during the update process which is writable by users. If malicious DLL files are placed within this directory...

Design/Logic Flaw

The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file...

CVE-2014-0904

The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file...

CVE-2014-0904: Improper Input Validation

The update process in IBM Security AppScan Standard 7.9 through 8.8 does not require integrity checks of downloaded files, which allows remote attackers to execute arbitrary code via a crafted file...

Files extracted during updates are not always read only — Mozilla

Security researcher Ash reported an issue where the extracted files for updates to existing files are not read only during the update process. This allows for the potential replacement or modification of these files during the update process if a malicious application is present on the local syst...

New BIOS available for Intel® Desktop Board products BIOS to prevent unauthorized downgrading to a previous BIOS version.

Summary: New BIOS is available for Intel® Desktop Board products BIOS to prevent downgrading to a previous BIOS version without supervisor/admin permission. Description: To prevent an unauthorized user from flashing Intel® Desktop Board products to a previous BIOS version without an explicit...

CVE-2008-3436

Notepad++ prior to 4.8.1 is affected by CVE-2008-3436 through its GUP generic update process, which does not properly verify update authenticity. This enables MITM attackers to deliver arbitrary code via a Trojan-horse update, as demonstrated by evilgrade and DNS cache poisoning. The provided con...

CVE-2008-3436: Improper Control of Generation of Code

The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

TSRT-06-05: Computer Associates eTrust AntiVirus WebScan Automatic Update Code Execution Vulnerability

TSRT-06-05: Computer Associates eTrust AntiVirus WebScan Automatic Update Code Execution Vulnerability http://www.tippingpoint.com/security/advisories/TSRT-06-05.html August 7, 2006 -- CVE ID: CVE-2006-3976 CVE-2006-3977 -- Affected Vendor: Computer Associates -- Affected Products: eTrust AntiVir...

ROS-2-4217

2.4217 Notification on the update of the Red OS OPERATIONAL SYSTEM MIS Due to quality improvement and bug fixing, an updated version of the "RED OS" Operating System "RED OS" 7.3 is released. You can contact the technical support service within the framework of your existing technical support...

Visual Studio 2019 version 16.11.0 to 16.11.18 update

This security update applies to all editions of Visual Studio 2019 between versions 16.11.0 and 16.11.17, and will update client machines to version 16.11.18. The client machines must be enabled to receive this administrator update, and by default Visual Studio must be closed on the client in ord...