Read Time:3 Second
Alert fatigue is a major issue, says Expel
Monthly Archives: April 2023
git-2.40.1-1.fc36
Read Time:43 Second
FEDORA-2023-003e7d2867
Packages in this update:
git-2.40.1-1.fc36
Update description:
update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
Refer to the release notes for 2.30.9 for details of each CVE as well as
the following security advisories from the git project:
https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx (CVE-2023-25652)
https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 (CVE-2023-29007)
(At this time there is no upstream advisory for CVE-2023-25815. This
issue does not affect the Fedora packages as we do not use the runtime
prefix support.)
Release notes:
https://github.com/git/git/raw/v2.30.9/Documentation/RelNotes/2.30.9.txt
https://github.com/git/git/raw/v2.40.1/Documentation/RelNotes/2.40.1.txt
git-2.40.1-1.fc38
Read Time:43 Second
FEDORA-2023-eaf1bdd5ae
Packages in this update:
git-2.40.1-1.fc38
Update description:
update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
Refer to the release notes for 2.30.9 for details of each CVE as well as
the following security advisories from the git project:
https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx (CVE-2023-25652)
https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 (CVE-2023-29007)
(At this time there is no upstream advisory for CVE-2023-25815. This
issue does not affect the Fedora packages as we do not use the runtime
prefix support.)
Release notes:
https://github.com/git/git/raw/v2.30.9/Documentation/RelNotes/2.30.9.txt
https://github.com/git/git/raw/v2.40.1/Documentation/RelNotes/2.40.1.txt
git-2.40.1-1.fc37
Read Time:43 Second
FEDORA-2023-d84a75ea52
Packages in this update:
git-2.40.1-1.fc37
Update description:
update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
Refer to the release notes for 2.30.9 for details of each CVE as well as
the following security advisories from the git project:
https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx (CVE-2023-25652)
https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 (CVE-2023-29007)
(At this time there is no upstream advisory for CVE-2023-25815. This
issue does not affect the Fedora packages as we do not use the runtime
prefix support.)
Release notes:
https://github.com/git/git/raw/v2.30.9/Documentation/RelNotes/2.30.9.txt
https://github.com/git/git/raw/v2.40.1/Documentation/RelNotes/2.40.1.txt
USN-6010-3: Firefox regressions
Read Time:1 Minute, 33 Second
USN-6010-1 fixed vulnerabilities and USN-6010-2 fixed minor regressions in
Firefox. The update introduced several minor regressions. This update fixes
the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2023-29537,
CVE-2023-29540, CVE-2023-29543, CVE-2023-29544, CVE-2023-29547,
CVE-2023-29548, CVE-2023-29549, CVE-2023-29550, CVE-2023-29551)
Irvan Kurniawan discovered that Firefox did not properly manage fullscreen
notifications using a combination of window.open, fullscreen requests,
window.name assignments, and setInterval calls. An attacker could
potentially exploit this issue to perform spoofing attacks. (CVE-2023-29533)
Lukas Bernhard discovered that Firefox did not properly manage memory
when doing Garbage Collector compaction. An attacker could potentially
exploits this issue to cause a denial of service. (CVE-2023-29535)
Zx from qriousec discovered that Firefox did not properly validate the
address to free a pointer provided to the memory manager. An attacker could
potentially exploits this issue to cause a denial of service.
(CVE-2023-29536)
Alexis aka zoracon discovered that Firefox did not properly validate the
URI received by the WebExtension during a load request. An attacker could
potentially exploits this to obtain sensitive information. (CVE-2023-29538)
Trung Pham discovered that Firefox did not properly validate the filename
directive in the Content-Disposition header. An attacker could possibly
exploit this to perform reflected file download attacks potentially
tricking users to install malware. (CVE-2023-29539)
Ameen Basha M K discovered that Firefox did not properly validate downloads
of files ending in .desktop. An attacker could potentially exploits this
issue to execute arbitrary code. (CVE-2023-29541)
#RSAC: Ransomware Poses Growing Threat to Five Eyes Nations
Read Time:6 Second
Representatives of four of the five Five Eyes nations outlined the growing threat ransomware poses and approaches to thwart it
#RSAC: Characterless Security Training Fails to Change User Behavior
Read Time:6 Second
Experts from Amazon and the NCA offered tips on how to engage end users with cyber awareness training
CVE-2012-5873
Read Time:7 Second
ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.
CVE-2012-5872
Read Time:7 Second
ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
New DDoS amplification vector could enable massive attacks
Read Time:31 Second
Security researchers sounded the alert about a vulnerability in an UDP-based network service called the Service Location Protocol (SLP) that can be abused to amplify DDoS attacks. Tens of thousands of systems and devices have this service exposed to the internet. Attackers could use them to generate massive attacks, and cleaning them up will likely take a very long time.
Researchers from security firms Bitsight and Curesec found a vulnerability that allows attackers to exploit SLP endpoints in a specific way that will generate big responses and then reflect those responses toward victims.