SUSE-SU-2020:3528-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: TODO - Mozilla Thunderbird 78.5.0 new: OpenPGP: Added option to disable attaching the public key to a signed message bmo1654950 new: MailExtensions: 'composeattachments' context added to Menus API bmo1670822 new: MailExtensions: Menus...

Atlassian Fisheye and Crucible Security Vulnerabilities

Atlassian Fisheye and Crucible are both products of Atlassian Australia.Atlassian Fisheye is a source code deep view software.Crucible is a code review tool. A security vulnerability exists in Atlassian Fisheye/Crucible that can be exploited by an attacker to affect the usability of an applicatio...

Real Life Comics App Has Denial of Service Vulnerability

Real Comics is a mobile comic app. A denial of service vulnerability exists in the Real Life Comics App, which can be exploited by attackers to have an impact on the usability of the application...

What’s New in InsightAppSec and tCell: Q3 2020 in Review

Here at Rapid7, we’ve been quite busy continuously improving, expanding functionality, and testing new features for feedback with our customers across our application security portfolio. This includes InsightAppSec, our leading DAST solution, tCell by Rapid7, our next-gen cloud WAF and RASP...

On Risk-Based Authentication

Interesting usability study: "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication": Abstract: Risk-based Authentication RBA is an adaptive security measure to strengthen password-based authentication. RBA monitors additional features during...

Rethinking Defensive Strategy at the Edge, Part 3: Strategies for Protective Action

Our three-part blog series, Re-thinking Defensive Strategy at the Edge, has been focusing on outlining a new defensive edge strategy for today's enterprise. We began with a discussion of data and indicators. Most recently, our second post focused on using risk signals and correlating them for...

Product update: Virtuozzo Hybrid Server 7.0 Update 14 Hotfix 2 (7.0.14-258)

The Hotfix 2 for Virtuozzo Hybrid Server 7.0 Update 14 provides security, stability, and usability bug fixes. Vulnerability id: PSBM-106197, CVE-2019-20839, CVE-2019-20840, CVE-2020-14396, CVE-2020-14397, CVE-2020-14398, CVE-2020-14399, CVE-2020-14400, CVE-2020-14401, CVE-2020-14402,...

Product update: Virtuozzo PowerPanel RTM Hotfix 8 (7.0.3-151)

The update for Virtuozzo PowerPanel introduces a security fix, a new feature, and stability and usability fixes. Vulnerability id: PP-568 PowerPanel web interface could be vulnerable to clickjacking...

Product update: Virtuozzo Hybrid Server 7.0 Update 14 Hotfix 1 (7.0.14-257)

The Hotfix 1 for Virtuozzo Hybrid Server 7.0 Update 14 provides stability and usability bug fixes. Vulnerability id: PSBM-105022 Unable to live-migrate VMs with dirty bitmaps on Virtuozzo Storage. Vulnerability id: PSBM-104631, PSBM-104632 CS journals to be placed on SSDs are now properly handled...

OPENSUSE-SU-2020:0852-1 Security update for osc

This update for osc to 0.169.1 fixes the following issues: Security issue fixed: - CVE-2019-3681: Fixed an insufficient validation of network-controlled filesystem paths bsc1122675. Non-security issues fixed: - Improved the speed and usability of osc bash completion. - improved some error message...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 3 (7.5.1-737)

The Hotfix 3 for Virtuozzo Hybrid Server 7.5 Update 1 provides a stability and usability bug fix. Vulnerability id: PSBM-130586 VM disk resize functionality could stop working for non-root users after upgrading to version 7.5.1...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 11 (VA MN: 7.0.2-649, VA Agent: 7.0.2-372)

Hotfix 11 for Virtuozzo Automator 7.0.2 provides stability and usability fixes. Vulnerability id: PVA-37488 Changing VM's OS distribution via API calls could reset the 'cpulimit' and 'iolimit' values. Vulnerability id: PVA-37495 VA Agent did not return the 'counterioused' value. Vulnerability id:...

Code injection

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 2 (7.5.1-736)

The Hotfix 2 for Virtuozzo Hybrid Server 7.5 Update 1 provides a stability and usability bug fix. All customers that use CloudBlue Cloud Infrastructure Automation with Virtuozzo Hybrid Server 7.5 and newer are strongly recommended to install the hotfix. Vulnerability id: PSBM-125586 Cloud...

Virtuozzo Hybrid Server 7.5 Update 1 Hotfix 1 (7.5.1-734)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 1 provides a new feature and a stability and usability bug fix. Vulnerability id: PSBM-129299 Version 1 ploop images of virtual environments created in Virtuozzo 6 and earlier could get corrupted after updating to Virtuozzo Hybrid Server 7.5.1...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 10 (VA MN: 7.0.2-647, VA Agent: 7.0.2-367)

Hotfix 10 for Virtuozzo Automator 7.0.2 provides stability and usability fixes. Vulnerability id: PVA-37446 Unable to set "Advanced firewall mode with the default policy Drop" for containers. Vulnerability id: PVA-37477 VA Agent could consume 100% of one CPU. Vulnerability id: PVA-37479 VA Agent...

Product update: Virtuozzo 7.0 Update 13 Hotfix 3 (7.0.13-306)

The Hotfix 3 for Virtuozzo 7.0 Update 13 provides a stability and usability bug fix. Vulnerability id: VSTOR-32856, VSTOR-32857 Unreadable files may be created when using erasure coding during the upgrade from Update 12 to 13. Fix such files with the command 'vstorage -c -A set-attr -p...

Product update: Virtuozzo 7.0 Update 13 Hotfix 2 (7.0.13-305)

The Hotfix 2 for Virtuozzo 7.0 Update 13 provides stability and usability bug fixes. Vulnerability id: PSBM-102741 Ability to check and fix containers with broken BAT. Vulnerability id: PSBM-102751 Under certain conditions, MDS could crash...

Logic Flaw Vulnerability in PopojiCMS

PopojiCMS is a content management system. A logic flaw vulnerability exists in PopojiCMS, which can be exploited by attackers to cause an impact on usability...

SUSE-SU-2020:0693-1 Security update for wireshark

This update for wireshark and libmaxminddb fixes the following issues: Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support bsc1156288. New features include: - Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC -...