Design/Logic Flaw

Yandex Browser for desktop before 17.1.1.227 does not show Protect similar to Safebrowsing in Chromium warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site...

CVE-2016-8508

Yandex Browser for desktop before 17.1.1.227 does not show Protect similar to Safebrowsing in Chromium warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site...

CVE-2016-8508

Yandex Browser for desktop before 17.1.1.227 does not show Protect similar to Safebrowsing in Chromium warnings in web-sites with special content-type, which could be used by remote attacker for prevention Protect warning on own malicious web-site...

CVE-2016-8508

CVE-2016-8508 affects Yandex Browser for desktop prior to 17.1.1.227. The issue is that the browser does not show Protect warnings (analogous to Safebrowsing) for web-sites with certain content-types, which could allow a remote attacker to silence protection warnings on a malicious site. The vuln...

openSUSE Security Update : lcms2 (openSUSE-2017-179)

This update for lcms2 to version 2.8 fixes the following issues : This security issue was fixed : - Fixed an out-of-bounds heap read in TypeMLURead that could be triggered by an untrusted image with a crafted ICC profile boo1021364. These non-security issues were fixed : - Fixed many typos in...

SHA-1 End Times Have Arrived

For the past couple of years, browser makers have raced to migrate from SHA-1 to SHA-2 as researchers have intensified warnings about collision attacks moving from theoretical to practical. In just weeks, a transition deadline set by Google, Mozilla and Microsoft for the deprecation of SHA-1 is u...

SUSE-SU-2016:3193-1 Security update for ntp

This update for ntp fixes the following issues: - Simplify ntpd's search for its own executable to prevent AppArmor warnings bsc956365. Security issues fixed update to 4.2.8p9: - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. -...

Oracle Linux 7 : systemd (ELSA-2016-2610)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2610 advisory. 219-30.0.1.3 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 22224874 - allow dm remove ioctl to co-operate with UEK3 Vaughan Cao Orabug: 18467469 - ad...

firewalld security, bug fix, and enhancement update

0.4.3.2-8 - Exclude firewallctl RHBZ1374799 0.4.3.2-7 - Tolerate ipv6rpfilter fail RHBZ1285769 - Fix setrules to copy the rule before extracting the table RHBZ1373260 - Translation update RHBZ1273296 - Conflict with NetworkManager 1:1.4.0-3.el7 RHBZ1366288 0.4.3.2-6 - Do not use exit code 254 for...

Microsoft Extends Macro Protection to Office 2013

Microsoft is combating a surge in macro-based malware with a new feature that allows system administrators to configure Office 2013 to block Word, Excel, and PowerPoint macros. The capability had previously been introduced in March by Microsoft for its Office 2016 software. Microsoft said inciden...

Remote Anonymous Denial of Service Vulnerability in OpenSSL (SSL Death Alert)

OpenSSL is an open source implementation of SSL used to implement strong encryption for network communications. OpenSSL is vulnerable to a remote anonymous denial of service vulnerability in that OpenSSL's implementation of the SSL/TLS protocol handshake allows a client to repeatedly send packets...

Vulnerabilities in Insulin Pumps Can Lead to Overdose

Patients who use insulin pumps made by Johnson & Johnson are being warned this week that vulnerabilities in the devices could be exploited to trigger an overdose. The bugs exist in OneTouch Ping, a medical device made by Animas Corp. – a subsidiary of Johnson & Johnson – which allows diabetic...

openSUSE Security Update : roundcubemail (openSUSE-2016-996)

This update for roundcubemail fixes the following vulnerabilities : - CVE-2015-8864: XSS issue in SVG images handling boo976988 - CVE-2015-2181: issue in DBMail driver of password plugin Roundcubemail was also updated to 1.0.9, fixing the following bugs : - Fix a regression where some contact dat...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)

This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...

Moneybird: Webhook allows sending payload using insecure HTTP protocol

Researcher noted that a non-secure HTTP endpoint is allowed in webhooks. We have decided to allow non-secure webhooks because too many API clients don't have HTTPS endpoints to receive our webhooks. We have added warnings to inform our clients what the security risks are, but cannot require HTTPS...

New Gmail Alerts Warn of Unauthenticated Senders

Google is expected soon to begin a gradual rollout of new security features in Gmail that warn users if the system could not authenticate the sender of an email message. Starting this week for browser-based users of Gmail and Android users, Google will display a question mark over a sender’s...

UBUNTU-CVE-2015-3854

packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICEPOWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350...

Command Line Certificate Examination Utility: certigo

Command Line Certificate Examination Utility Certigo is a utility to examine and validate certificates in a variety of formats. Install To install certigo, simply use: go get -u github.com/square/certigo Note that certigo requires Go 1.6 or later to build. Usage Certigo can read...

SUSE-SU-2016:1538-1 Security update for libxml2

This update for libxml2 fixes the following security issues: - CVE-2016-2073, CVE-2015-8806, CVE-2016-1839: A Heap-buffer overread was fixed in libxml2/dict.c bsc963963, bsc965283, bsc981114. - CVE-2016-4483: Code was added to avoid an out of bound access when serializing malformed strings...

[SECURITY] [DLA 487-1] debian-security-support - Long term security support update

Package : debian-security-support Version : 2016.05.24deb7u1 The Debian Long Term Support LTS Team is unable to continue supporting different packages in the extended life cycle of Wheezy LTS. The debian-security-support package provides the check-support-status tool that helps to warn the...