Read Time:8 Second
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none.
Monthly Archives: February 2023
CVE-2018-12128
Read Time:8 Second
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none.
CVE-2018-12125
Read Time:8 Second
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues. Notes: none.
Researchers Discover Nearly 200,000 New Mobile Banking Trojan Installers
Read Time:4 Second
Kaspersky said the figures are more than double what the team observed in 2021
USN-5888-1: Python vulnerabilities
Read Time:50 Second
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially
crafted input file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2015-20107)
Hamza Avvan discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2021-28861)
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2022-37454, CVE-2022-42919)
It was discovered that Python incorrectly handled certain inputs. If a
user or an automated system were tricked into running a specially
crafted input, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-45061, CVE-2023-24329)
News Corp Reveals Two-Year-Long Breach
Read Time:4 Second
A threat actor accessed business documents and emails between February 2020 and January 2022
ChromeLoader Malware Poses as Steam, Nintendo Game Mods
Read Time:4 Second
Asec said the malicious activity observed relied on VHD disk image files
USN-5895-1: MPlayer vulnerabilities
Read Time:1 Minute, 10 Second
It was discovered that MPlayer could be made to divide by zero when
processing certain malformed media files. If a user were tricked into
opening a specially crafted media file, an attacker could possibly use
this issue to cause MPlayer to crash, resulting in a denial of service.
(CVE-2022-38850, CVE-2022-38860, CVE-2022-38865)
It was discovered that MPlayer could be made to read out of bounds when
processing certain malformed media files. If a user were tricked into
opening a specially crafted media file, an attacker could possibly use
this issue to cause MPlayer to crash, resulting in a denial of service.
(CVE-2022-38851)
It was discovered that MPlayer could be made to write out of bounds when
processing certain malformed media files. If a user were tricked into
opening a specially crafted media file, an attacker could possibly use
this issue to cause MPlayer to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2022-38855, CVE-2022-38858,
CVE-2022-38863, CVE-2022-38864, CVE-2022-38866)
It was discovered that MPlayer did not properly managed memory when
processing certain malformed media files. If a user were tricked into
opening a specially crafted media file, an attacker could possibly use
this issue to cause MPlayer to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2022-38861)
“Ethical hacker” amongst those arrested in Dutch ransomware investigation
Read Time:10 Second
Three men have been arrested by Dutch police in connection with ransomware attacks that blackmailed thousands of companies. Amongst them? An ethical hacker.
Read more in my article on the Hot for Security blog.
USN-5894-1: curl vulnerabilities
Read Time:28 Second
Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled
TELNET connections when the -t option was used on the command line.
Uninitialized data possibly containing sensitive information could be sent
to the remote server, contrary to expectations. This issue was only fixed
in Ubuntu 14.04 ESM. (CVE-2021-22898, CVE-2021-22925)
It was discovered that curl incorrectly handled denials when using HTTP
proxies. A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2022-43552)