Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
7 New Flaws Affect All Thunderbolt-equipped Computers Sold in the Last 9 Years
A cybersecurity researcher today uncovers a set of 7 new unpatchable hardware vulnerabilities that affect all desktops and laptops sold in the past 9 years wit…
SQL Injection Vulnerability In Sophos XG Firewall That Was Under Active Exploit
A serious vulnerability in Sophos XG Firewall was under exploit. Specifically, hackers abused this bug to steal data from targetSQL Injection Vulnerability In …
Researcher Discloses 4 Zero-Day Bugs in IBM's Enterprise Security Software
A cybersecurity researcher today publicly disclosed technical details and PoC for 4 unpatched zero-day vulnerabilities affecting an enterprise security softwar…
SciLinux: SLSA-2020-1509-1 Important: java-11-openjdk on SL7.x x86_
OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803) * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 82…
Researchers Find Security Vulnerabilities In Some of The Top Password Managers
While password managers are meant to protect users' credentials and underlying sensitive data, they do not necessarily warrant fool-proof security.Researchers …
Debian: DSA-4643-1: python-bleach security upda
It was reported that python-bleach, a whitelist-based HTML-sanitizing library, is prone to a mutation XSS vulnerability in bleach.clean when strip=False and 'm…
SciLinux: SLSA-2020-0905-1 Important: thunderbird on SL7.x x86_
Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputStreamReady was missing protections against state confus…
How CISOs Should Prepare for Coronavirus Related Cybersecurity Threats
The Coronavirus is hitting hard on the world's economy, creating a high volume of uncertainty within organizations.Cybersecurity firm Cynet today revealed new …
SciLinux: SLSA-2020-0816-1 Important: firefox on SL6.x i386/x86_
This update upgrades Firefox to version 68.6.0 ESR. * Mozilla: Use-after-free when removing data about origins (CVE-2020-6805) * Mozilla: BodyStream::OnInputSt…
This Unpatchable Flaw Affects All Intel CPUs Released in Last 5 Years
All Intel processors released in the past 5 years contain an unpatchable vulnerability that could allow hackers to compromise almost every hardware-enabled sec…
Debian LTS: DLA-2134-1: pdfresurrect security upda
It was discovered that there was an out-of-bounds write vulnerability in pdfresurrect, a tool for extracting or scrubbing versioning data from PDF documents.
Ubuntu 4296-1: Django vulnerabili
Django could allow unintended access to the database.
Debian LTS: DLA-2130-1: libapache2-mod-auth-openidc securi
An issue has been found in libapache2-mod-auth-openidc, an OpenID Connect authentication module for Apache. Due to insufficient validatation of URLs an Open Re…
Debian: DSA-4635-1: proftpd-dfsg security upda
Antonio Morales discovered an user-after-free flaw in the memory pool allocator in ProFTPD, a powerful modular FTP/SFTP/FTPS server. Interrupting current data …
Mageia 2020-0097: ipmitool security upda
Updated ipmitool package fix security vulnerability: Christopher Ertl found that multiple functions in ipmitool neglect proper checking of the data received f…
Mageia 2020-0096: upx security upda
The updated packages fix security vulnerabilities: PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (do…
Mageia 2020-0084: exiv2 security upda
The updated packages fix a security vulnerability: In Jp2Image::readMetadata() in jp2image.cpp in Exiv2 0.27.2, an input file can result in an infinite loop a…
Open-Source Security in 2020: Myths and Fac
Open-source software isn't a completely chaotic and breached wasteland of vulnerabilities. It's a global effort to make the development lifecycle faster.
Debian LTS: DLA-2098-1: ipmitool security upda
Christopher Ertl found that multiple functions in ipmitool neglect proper checking of the data received from a remote LAN party, which may lead to buffer overf…
Mageia 2020-0070: sqlite3 security upda
Updated sqlite3 packages fix security vulnerabilities: An out of bounds write flaw (CVE-2019-13734), insufficient data validation flaw (CVE-2019-13750), unini…
Mageia 2020-0057: fontforge security upda
FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c (CVE-2020-5395) FontForge 20190801 has a heap-based buffer overflow in the Type2NotDef…
SciLinux: SLSA-2020-0203-1 Important: libarchive on SL7.x x86_
libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry (CVE-2019-18408) SL7 x86_64 lib…
RedHat: RHSA-2020-0172:01 Moderate: openvswitch2.12 security and bug f
An update for openvswitch2.12 is now available for Fast Datapath for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Mode…
RedHat: RHSA-2020-0171:01 Moderate: openvswitch2.11 security and bug f
An update for openvswitch2.11 is now available for Fast Datapath for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Mode…