Read Time:3 Second
Some 90% of risk is still uninsured, warns industry giant
Daily Archives: November 8, 2022
The 15 biggest data breaches of the 21st century
Read Time:33 Second
In today’s data-driven world, data breaches can affect hundreds of millions or even billions of people at a time. Digital transformation has increased the supply of data moving, and data breaches have scaled up with it as attackers exploit the data-dependencies of daily life. How large cyberattacks of the future might become remains speculation, but as this list of the biggest data breaches of the 21st Century indicates, they have already reached enormous magnitudes.
[ Learn the The 5 types of cyberattack you’re most likely to face. | Get the latest from CSO by signing up for our newsletters. ]
Silk Road Thief Pleads Guilty to $3.4bn Raid
USN-5714-1: LibTIFF vulnerabilities
Read Time:2 Minute, 18 Second
It was discovered that LibTIFF incorrectly handled certain memory operations
when using tiffcrop. An attacker could trick a user into processing a specially
crafted tiff image file and potentially use this issue to cause a denial of
service. This issue only affected Ubuntu 22.10. (CVE-2022-2519, CVE-2022-2520,
CVE-2022-2521, CVE-2022-2953)
It was discovered that LibTIFF did not properly perform bounds checking in
certain operations when using tiffcrop. An attacker could trick a user into
processing a specially crafted tiff image file and potentially use this issue
to allow for information disclosure or to cause the application to crash. This
issue only affected to Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-2867, CVE-2022-2868, CVE-2022-2869)
It was discovered that LibTIFF did not properly perform bounds checking in
certain operations when using tiffsplit. An attacker could trick a user into
processing a specially crafted tiff image file and potentially use this issue
to allow for information disclosure or to cause the application to crash. This
issue only affected to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-34526)
Chintan Shah discovered that LibTIFF incorrectly handled memory in certain
conditions when using tiffcrop. An attacker could trick a user into processing
a specially crafted image file and potentially use this issue to allow for
information disclosure or to cause the application to crash. This issue only
affected to Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04
LTS and Ubuntu 22.10. (CVE-2022-3570)
It was discovered that LibTIFF incorrectly handled memory in certain conditions
when using tiffcrop. An attacker could trick a user into processing a specially
crafted tiff file and potentially use this issue to cause a denial of service.
This issue only affected to Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3598)
It was discovered that LibTIFF did not properly perform bounds checking in
certain operations when using tiffcrop. An attacker could trick a user into
processing a specially crafted tiff image file and potentially use this issue
to allow for information disclosure or to cause the application to crash.
(CVE-2022-3599)
It was discovered that LibTIFF did not properly perform bounds checking in
certain operations when using tiffcrop. An attacker could trick a user into
processing a specially crafted tiff image file and potentially use this issue
to allow for information disclosure or to cause the application to crash. This
issue only affected to Ubuntu 22.10. (CVE-2022-3626, CVE-2022-3627)
CVE-2020-35473
Read Time:30 Second
An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended scan response in Bluetooth Core Specifications 5.0 through 5.2, may be used to identify devices using Resolvable Private Addressing (RPA) by their response or non-response to specific scan requests from remote addresses. RPAs that have been associated with a specific remote device may also be used to identify a peer in the same manner by using its reaction to an active scan request. This has also been called an allowlist-based side channel.
APPLE-SA-2022-11-01-1 Xcode 14.1
Read Time:26 Second
Posted by Apple Product Security via Fulldisclosure on Nov 07
APPLE-SA-2022-11-01-1 Xcode 14.1
Xcode 14.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213496.
Git
Available for: macOS Monterey 12.5 and later
Impact: Multiple issues in git
Description: Multiple issues were addressed by updating to git
version 2.32.3.
CVE-2022-29187: Carlo Marcelo Arenas Belón and Johannes Schindelin
Git
Available for: macOS Monterey 12.5 and later…
CVE-2022-3602 and CVE-2022-3786 Critical OpenSSL 3.0.x security vulnerabilities
Read Time:24 Second
Posted by Turritopsis Dohrnii Teo En Ming on Nov 07
Subject: CVE-2022-3602 and CVE-2022-3786 Critical OpenSSL 3.0.x
security vulnerabilities
Good day from Singapore,
Please refer to the following posts. The story is developing.
[1] OpenSSL Gives Heads Up to Critical Vulnerability Disclosure, Check
Point Alerts Organizations to Prepare Now
Link:
https://blog.checkpoint.com/2022/10/30/openssl-gives-heads-up-to-critical-vulnerability-disclosure-check-point-alerts-organizations-to-prepare-now/…
DSA-5273 webkit2gtk – security update
Read Time:3 Second
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
DSA-5274 wpewebkit – security update
Read Time:4 Second
The following vulnerabilities have been discovered in the WPE WebKit
web engine: