Read Time:9 Second
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none.
Daily Archives: February 22, 2023
5 top threats from 2022 most likely to strike in 2023
Read Time:55 Second
The threat landscape is highly diverse and attacks range in sophistication from the most basic scams to nation-state-level cyberespionage. However, companies need to prioritize their defenses against the most common threats that are likely to impact them and their employees.
In its newly released annual State of Malware report, cybersecurity firm Malwarebytes selected five threats that they consider to be archetypes for some of the most common malware families observed in 2022:
LockBit ransomware
The Emotet botnet
The SocGholish drive-by download
Android droppers
macOS Genio adware
“Protecting your business for the rest of 2023 requires one critical understanding: The most dangerous cyberthreats you will face are not the strangest attacks you will see on any given week, or the most sophisticated, or the most eye-catching. They are not even the most prevalent,” the company said in its report. “Instead, the most dangerous threats come from a set of known, mature tools and tactics that an entire ecosystem of cybercriminals rely upon to take in billions of dollars a year.”
5 top threats from 2022 most likely to strike in 2023
Read Time:55 Second
The threat landscape is highly diverse and attacks range in sophistication from the most basic scams to nation-state-level cyberespionage. However, companies need to prioritize their defenses against the most common threats that are likely to impact them and their employees.
In its newly released annual State of Malware report, cybersecurity firm Malwarebytes selected five threats that they consider to be archetypes for some of the most common malware families observed in 2022:
LockBit ransomware
The Emotet botnet
The SocGholish drive-by download
Android droppers
macOS Genio adware
“Protecting your business for the rest of 2023 requires one critical understanding: The most dangerous cyberthreats you will face are not the strangest attacks you will see on any given week, or the most sophisticated, or the most eye-catching. They are not even the most prevalent,” the company said in its report. “Instead, the most dangerous threats come from a set of known, mature tools and tactics that an entire ecosystem of cybercriminals rely upon to take in billions of dollars a year.”
Hackers blamed after Russian radio stations play warnings of missile strikes and air raids
Read Time:8 Second
Russian media has blamed hackers after commercial radio stations in the country broadcast bogus warnings about air raids and missile strikes, telling listeners to head to shelters.
bluedevil-5.27.1-1.fc37 breeze-gtk-5.27.1-1.fc37 flatpak-kcm-5.27.1-1.fc37 grub2-breeze-theme-5.27.1-1.fc37 kactivitymanagerd-5.27.1-1.fc37 kde-cli-tools-5.27.1-1.fc37 kde-gtk-config-5.27.1-1.fc37 kdecoration-5.27.1-1.fc37 kdeplasma-addons-5.27.1-1.fc37 kgamma-5.27.1-1.fc37 khotkeys-5.27.1-1.fc37 kinfocenter-5.27.1-1.fc37 kmenuedit-5.27.1-1.fc37 kpipewire-5.27.1-1.fc37 kscreen-5.27.1.1-1.fc37 kscreenlocker-5.27.1-1.fc37 ksshaskpass-5.27.1-1.fc37 ksystemstats-5.27.1-1.fc37 kwayland-integration-5.27.1-1.fc37 kwin-5.27.1-2.fc37 kwrited-5.27.1-1.fc37 layer-shell-qt-5.27.1-1.fc37 libkscreen-qt5-5.27.1-1.fc37 libksysguard-5.27.1-1.fc37 oxygen-sounds-5.27.1-1.fc37 pam-kwallet-5.27.1-1.fc37 plasma-breeze-5.27.1-1.fc37 plasma-browser-integration-5.27.1-1.fc37 plasma-desktop-5.27.1-1.fc37 plasma-discover-5.27.1-2.fc37 plasma-disks-5.27.1-1.fc37 plasma-drkonqi-5.27.1-1.fc37 plasma-firewall-5.27.1-1.fc37 plasma-integration-5.27.1-1.fc37 plasma-milou-5.27.1-1.fc37 plasma-mobile-5.27.1-1.fc37 plasma-nano-5.27.1-1.fc37 plasma-nm-5.27.1-1.fc37 plasma-oxygen-5.27.1-1.fc37 plasma-pa-5.27.1-1.fc37 plasma-sdk-5.27.1-1.fc37 plasma-systemmonitor-5.27.1-1.fc37 plasma-systemsettings-5.27.1-1.fc37 plasma-thunderbolt-5.27.1-1.fc37 plasma-vault-5.27.1-1.fc37 plasma-welcome-5.27.1-1.fc37 plasma-workspace-5.27.1-1.fc37 plasma-workspace-wallpapers-5.27.1-1.fc37 plymouth-kcm-5.27.1-1.fc37 plymouth-theme-breeze-5.27.1-1.fc37 polkit-kde-5.27.1-1.fc37 powerdevil-5.27.1-1.fc37 qqc2-breeze-style-5.27.1-1.fc37 sddm-kcm-5.27.1-1.fc37 xdg-desktop-portal-kde-5.27.1-1.fc37
Read Time:2 Minute, 3 Second
FEDORA-2023-e31c3e4b6c
Packages in this update:
bluedevil-5.27.1-1.fc37
breeze-gtk-5.27.1-1.fc37
flatpak-kcm-5.27.1-1.fc37
grub2-breeze-theme-5.27.1-1.fc37
kactivitymanagerd-5.27.1-1.fc37
kde-cli-tools-5.27.1-1.fc37
kdecoration-5.27.1-1.fc37
kde-gtk-config-5.27.1-1.fc37
kdeplasma-addons-5.27.1-1.fc37
kgamma-5.27.1-1.fc37
khotkeys-5.27.1-1.fc37
kinfocenter-5.27.1-1.fc37
kmenuedit-5.27.1-1.fc37
kpipewire-5.27.1-1.fc37
kscreen-5.27.1.1-1.fc37
kscreenlocker-5.27.1-1.fc37
ksshaskpass-5.27.1-1.fc37
ksystemstats-5.27.1-1.fc37
kwayland-integration-5.27.1-1.fc37
kwin-5.27.1-2.fc37
kwrited-5.27.1-1.fc37
layer-shell-qt-5.27.1-1.fc37
libkscreen-qt5-5.27.1-1.fc37
libksysguard-5.27.1-1.fc37
oxygen-sounds-5.27.1-1.fc37
pam-kwallet-5.27.1-1.fc37
plasma-breeze-5.27.1-1.fc37
plasma-browser-integration-5.27.1-1.fc37
plasma-desktop-5.27.1-1.fc37
plasma-discover-5.27.1-2.fc37
plasma-disks-5.27.1-1.fc37
plasma-drkonqi-5.27.1-1.fc37
plasma-firewall-5.27.1-1.fc37
plasma-integration-5.27.1-1.fc37
plasma-milou-5.27.1-1.fc37
plasma-mobile-5.27.1-1.fc37
plasma-nano-5.27.1-1.fc37
plasma-nm-5.27.1-1.fc37
plasma-oxygen-5.27.1-1.fc37
plasma-pa-5.27.1-1.fc37
plasma-sdk-5.27.1-1.fc37
plasma-systemmonitor-5.27.1-1.fc37
plasma-systemsettings-5.27.1-1.fc37
plasma-thunderbolt-5.27.1-1.fc37
plasma-vault-5.27.1-1.fc37
plasma-welcome-5.27.1-1.fc37
plasma-workspace-5.27.1-1.fc37
plasma-workspace-wallpapers-5.27.1-1.fc37
plymouth-kcm-5.27.1-1.fc37
plymouth-theme-breeze-5.27.1-1.fc37
polkit-kde-5.27.1-1.fc37
powerdevil-5.27.1-1.fc37
qqc2-breeze-style-5.27.1-1.fc37
sddm-kcm-5.27.1-1.fc37
xdg-desktop-portal-kde-5.27.1-1.fc37
Update description:
Plasma 5.27.1
Add patch to disable global shortcuts at login for the SDDM Plasma Wayland configuration (#2171332)
USN-5883-1: Linux kernel (HWE) vulnerabilities
Read Time:4 Minute, 10 Second
Kyle Zeng discovered that the sysctl implementation in the Linux kernel
contained a stack-based buffer overflow. A local attacker could use this to
cause a denial of service (system crash) or execute arbitrary code.
(CVE-2022-4378)
It was discovered that an out-of-bounds write vulnerability existed in the
Video for Linux 2 (V4L2) implementation in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-20369)
Pawan Kumar Gupta, Alyssa Milburn, Amit Peled, Shani Rehana, Nir Shildan
and Ariel Sabba discovered that some Intel processors with Enhanced
Indirect Branch Restricted Speculation (eIBRS) did not properly handle RET
instructions after a VM exits. A local attacker could potentially use this
to expose sensitive information. (CVE-2022-26373)
David Leadbeater discovered that the netfilter IRC protocol tracking
implementation in the Linux Kernel incorrectly handled certain message
payloads in some situations. A remote attacker could possibly use this to
cause a denial of service or bypass firewall filtering. (CVE-2022-2663)
Johannes Wikner and Kaveh Razavi discovered that for some AMD x86-64
processors, the branch predictor could by mis-trained for return
instructions in certain circumstances. A local attacker could possibly use
this to expose sensitive information. (CVE-2022-29900)
Johannes Wikner and Kaveh Razavi discovered that for some Intel x86-64
processors, the Linux kernel’s protections against speculative branch
target injection attacks were insufficient in some circumstances. A local
attacker could possibly use this to expose sensitive information.
(CVE-2022-29901)
It was discovered that a race condition existed in the Kernel Connection
Multiplexor (KCM) socket implementation in the Linux kernel when releasing
sockets in certain situations. A local attacker could use this to cause a
denial of service (system crash). (CVE-2022-3521)
It was discovered that the Netronome Ethernet driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3545)
It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux
kernel did not properly perform bounds checking in some situations. A
physically proximate attacker could use this to craft a malicious USB
device that when inserted, could cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2022-3628)
It was discovered that a use-after-free vulnerability existed in the
Bluetooth stack in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2022-3640)
It was discovered that the NILFS2 file system implementation in the Linux
kernel did not properly deallocate memory in certain error conditions. An
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2022-3646)
Khalid Masum discovered that the NILFS2 file system implementation in the
Linux kernel did not properly handle certain error conditions, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service or possibly execute arbitrary code. (CVE-2022-3649)
Hyunwoo Kim discovered that an integer overflow vulnerability existed in
the PXA3xx graphics driver in the Linux kernel. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2022-39842)
It was discovered that a race condition existed in the SMSC UFX USB driver
implementation in the Linux kernel, leading to a use-after-free
vulnerability. A physically proximate attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2022-41849)
It was discovered that a race condition existed in the Roccat HID driver in
the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2022-41850)
It was discovered that a race condition existed in the Xen network backend
driver in the Linux kernel when handling dropped packets in certain
circumstances. An attacker could use this to cause a denial of service
(kernel deadlock). (CVE-2022-42328)
Tamás Koczka discovered that the Bluetooth L2CAP implementation in the
Linux kernel did not properly initialize memory in some situations. A
physically proximate attacker could possibly use this to expose sensitive
information (kernel memory). (CVE-2022-42895)
It was discovered that the USB monitoring (usbmon) component in the Linux
kernel did not properly set permissions on memory mapped in to user space
processes. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2022-43750)
It was discovered that the Upper Level Protocol (ULP) subsystem in the
Linux kernel did not properly handle sockets entering the LISTEN state in
certain protocols, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-0461)
USN-5882-1: DCMTK vulnerabilities
Read Time:1 Minute, 54 Second
Gjoko Krstic discovered that DCMTK incorrectly handled buffers. If a user or
an automated system were tricked into opening a certain specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8979)
Omar Ganiev discovered that DCMTK incorrectly handled buffers. If a user or
an automated system were tricked into opening a certain specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-1010228)
Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2021-41687,
CVE-2021-41688, CVE-2021-41689, and CVE-2021-41690)
Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled
certain inputs. If a user or an automated system were tricked into opening
a certain specially crafted input file, a remote attacker could possibly use
this issue to execute arbitrary code. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-2119 and CVE-2022-2120)
Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled
pointers. If a user or an automated system were tricked into opening a
certain specially crafted input file, a remote attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2022-2121)
It was discovered that DCMTK incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue affected Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10.
(CVE-2022-43272)
Open Source Flaws Found in 84% of Codebases
Read Time:4 Second
The figures come from Synopsys’ new Open Source Security and Risk Analysis report
Entitle debuts with automated SaaS permissions-management application
Read Time:39 Second
Cloud-based permissions management startup Entitle debuted Wednesday with the launch of its namesake SaaS-based application, designed to automate access requests and solve the problem of what it calls the “entitlement sprawl” faced by corporations.
Enterprise security teams are confronted with an overwhelming amount of permission requests, the Israel-based company said.
“We saw that permission management is becoming a big issue and interviewed heads of security about the challenges with governance and relevance of access,” said Ron Nissam, co-founder and CEO of Entitle. “We quickly realized that many of the challenges that security teams are facing in governance of access actually originated upstream in the IT and devops departments and how employees got permissions to begin with.”
golang-1.19.6-1.fc36
Read Time:22 Second
FEDORA-2023-ce66f112b2
Packages in this update:
golang-1.19.6-1.fc36
Update description:
go1.19.6 (released 2023-02-14) includes security fixes to the crypto/tls, mime/multipart, net/http, and path/filepath packages, as well as bug fixes to the go command, the linker, the runtime, and the crypto/x509, net/http, and time packages. See the Go 1.19.6 milestone on the upstream issue tracker for details.