CVE-2010-10009

Read Time:16 Second

A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is 26829bba67858ca0bd4ce49ad50e7ce653914276. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218519.

Read More

QuSecure launches quantum-computing based security for endpoints

Read Time:34 Second

QuSecure, a quantum-computing technology company based in Silicon Valley, today announced the latest version of its security platform, called QuEverywhere — designed to allow organizations to extend quantum-safe security all the way to endpoints like laptops and smartphones, the company said in a statement.

QuEverywhere, according to the company, is an app- or browser-based method of applying quantum cryptography to connections or transactions on a given platform. It’s based largely on the company’s proxy server technology, which uses quantum technology housed in QuSecure’s Quark Orchestrator to handle encryption, decryption and session management for any system to which it is applied.

To read this article in full, please click here

Read More

USN-5811-2: Sudo vulnerability

Read Time:19 Second

USN-5811-1 fixed a vulnerability in Sudo. This update provides
the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)

Read More

USN-5811-1: Sudo vulnerabilities

Read Time:26 Second

Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly
handled user-specified editors when using the sudoedit command. A local
attacker that has permission to use the sudoedit command could possibly use
this issue to edit arbitrary files. (CVE-2023-22809)

It was discovered that the Protobuf-c library, used by Sudo, incorrectly
handled certain arithmetic shifts. An attacker could possibly use this
issue to cause Sudo to crash, resulting in a denial of service. This issue
only affected Ubuntu 22.04 LTS. (CVE-2022-33070)

Read More

Drupal core – Moderately critical – Information Disclosure – SA-CORE-2023-001

Read Time:1 Minute, 22 Second
Project: 
Date: 
2023-January-18
Vulnerability: 
Information Disclosure
Affected versions: 
>=8.0.0 <9.4.10 || >=9.5.0 <9.5.2 || >=10.0.0 <10.0.2
Description: 

The Media Library module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access.

The vulnerability is mitigated by the fact that the inaccessible media will only be visible to users who can already edit content that includes a media reference field.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

If you are using Drupal 10.0, update to Drupal 10.0.2.
If you are using Drupal 9.5, update to Drupal 9.5.2.
If you are using Drupal 9.4, update to Drupal 9.4.10.

All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Drupal 7 core does not include the Media Library module and therefore is not affected.

Reported By: 
Fixed By: 
Lee Rowlands of the Drupal Security Team
Dan Flanagan
Sean Blommaert
xjm of the Drupal Security Team
Benji Fisher of the Drupal Security Team
Dave Long of the Drupal Security Team
Jen Lampton, provisional member of the Drupal Security Team
Sascha Grossenbacher
Lauri Eskola, provisional member of the Drupal Security Team

Read More