Why Employee Cybersecurity Awareness Training Is Important

Read Time:7 Second

Not everyone invests in employee cybersecurity awareness training. Here’s four experts’ thoughts on why you should – and a way to save in the process!

Read More

USN-6555-2: X.Org X Server vulnerabilities

Read Time:32 Second

USN-6555-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled XKB
button actions. An attacker could possibly use this issue to cause the X
Server to crash, execute arbitrary code, or escalate privileges.
(CVE-2023-6377)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the RRChangeOutputProperty and
RRChangeProviderProperty APIs. An attacker could possibly use this issue to
cause the X Server to crash, or obtain sensitive information.
(CVE-2023-6478)

Read More

Five Ways To Protect Your Kids From Inappropriate Online Content

Read Time:7 Minute, 5 Second

Inquisitive, curious and fiercely independent. These are the three words that come to mind when I remember my boys as tweens and teens. Now, these are all wonderful qualities but when you’re trying to teach your kids to navigate the internet, these ‘wonderful’ qualities can often make things a little harder!! Curious types want to discover and investigate – that’s natural! But it also makes our job as parents even more challenging, particularly when it comes to protecting them from the slew of inappropriate content that can be found online. 

What Is Inappropriate Content? 

In short, inappropriate content is anything your kids may find online that they find disturbing or are not yet ready for, developmentally. It may be an image, a video or written text that is offensive and upsetting. Now, this could happen accidentally but also deliberately.  

Many of us immediately think of sexually explicit material when we think of inappropriate content but there is, unfortunately, more. It can also include material that promotes extremism or terrorism, violent imagery or copy, hateful or offensive sites or posts as well as false or misleading information. 

How Many Aussie Kids Have Been Exposed? 

As you can imagine, it’s hard to find accurate data as to how many kids have seen inappropriate content. Many kids would loathe to admit what they have seen, feel embarrassed or are simply too distressed to report their experience. So, it’s likely that the real statistics are higher than the reported data. Research undertaken by our eSafety Office shows that a high proportion of Aussie kids aged 12 to 17 have seen inappropriate content. Here are the details: 

57% have seen real violence that they considered disturbing 
Nearly 50% of kids aged 9 to 16 have regular exposure to sexual images 
33% have seen images or videos promoting terrorism 

What You Can Do To Minimise Your Kids Seeing Inappropriate Content? 

Is it inevitable that you will see something inappropriate online? I wish I could answer no, but the reality is that at some stage it is likely that your kids will see something that they find confusing or upsetting. So, the aim of the parental game here is to ensure this happens as late as possible and that they are ready for it. Here is where I suggest you put your energy into making this happen: 

1. Set Ground Rules 

I am a big fan of a family tech agreement that outlines your expectations of your kids’ online behaviour and the family’s ‘rules of engagement.’ This should be age appropriate but if your kids are young enough then please include a list of the sites they can visit, the apps they can download and the information they can share – nothing personally identifiable. I would also include rules about device usage – no devices in bedrooms overnight!! Check out my post here that will help you tailor an agreement for your family.  

A clear and detailed agreement means that every family member has clarity on the rules that will keep them safe. I find sharing the ‘why’ with my kids so important – so ensure they know you’re your goal here is to keep them safe and set them up for a positive online experience.  

2. Communicate Regularly, Openly and Calmly 

Go out of your way to create a home environment when your kids feel comfortable talking and sharing about all aspects of their lives without judgement. Once you have this, then you will be able to have regular conversations that will help them better understand the online world and most importantly, keep them safe! The goal here is to have genuine 2-way conversations without them feeling like they are being lectured at. For example, you can explain that anything they share online creates their own ‘digital footprint’ so they need to be mindful of how they conduct themselves, You could also talk them through the dangers of spreading rumours online or sharing hurtful photos or jokes.  

And if your kids know they can talk to you about anything and that you won’t overact, then they are more likely to tell you if they have seen something online that has worried them. Now, we all hope that doesn’t happen, but we all want to be able to help our kids navigate challenges if and when they arise. 

3. Consider Parental Controls 

Parental controls can be a really helpful tool that allows you to monitor and manage what your child sees and does online. Of course, using parental controls is not a silver bullet – you still need to remain vigilant and invested however it can be a great thing to have in your toolbox. Here’s what I Iike: 

They can block your child from accessing specific websites or apps – for example using a camera or purchasing goods 
They can filter out inappropriate content eg sexual content, content that promotes self-harm, violence, gambling or racism 
They can monitor your child’s time online and provide reports on the sites they visit, the apps they use and the frequency and time they have spent on each 
They can set time limits and block your child’s access after a set time 

Check out more information about McAfee’s parental controls here.   

 4. Use Child Friendly Search Engines 

As we all know, the sky is the limit when it comes to finding anything online. So, young curious minds have ample opportunity to have their every question answered. However, this is not ideal when your kids have neither age nor experience on your side. So, let me introduce you to some child-friendly search engines that will ensure there are healthy boundaries for inquisitive minds!  

Kiddle 

This is a search engine that’s designed to produce safe results for kids so it will produce quite limited results – perfect! It has been designed to block swear words and ‘rude’ language but a Commonsense Media trial found that some violent content could be generated using it. 

Kidzsearch 

This search engine uses Google’s strict filtering software to produce up-to-date results without the risk of anything inappropriate. Their advanced keyword filtering system monitors for alternate and modified spellings which is great for youngins! 

KidRex 

Also using Google’s SafeSearch, KidRex promotes kid-friendly pages in its results. It also has an additional database of inappropriate keywords and sites and blocks social media results. How good!  

But, if you just want to stick with Google and turn on the SafeSearch filters, you absolutely can. Just remember, that you’ll need to activate it on every device that your kids might use – including their phone! 

4. Be Open And A Great Role Model 

How often do you hear yourself saying or doing something your mother does? I do all the time! Our parents are our biggest influence and are our biggest role models. And this also applies to how we engage with technology. Make sure your kids see you enjoying tech-free time, so they ‘normalise’ this. Leave your phone at home when you walk the dog, never have phones at the dinner table and always turn your phone on do not disturb when talking with your kids. The less time spent on technology means the more time for real in-person human connection. 

Being open is also an imperative way to protect your kids. In fact, the more open and communicative you are with your kids, the less reason they will have to undertake their own ‘research’ online. So, if you’ve created an environment where talking about puberty, hormonal changes and teenage relationships is normal, chances are they won’t need to turn to Google for answers – and risk seeing inappropriate content.   

So, if you have a tribe of curious tweens or teens, then I’m sending you my very best. It’s not an easy task protecting them from some of the more challenging content that the internet can offer. But having come out the other side – and survived – I can assure you that the more proactive you are, the easier the ride will be.  

Good luck!!

Alex XX 

PS If you’re thinking about parental controls, don’t forget about enabling these on your streaming services too. Netflix, Amazon Prime and Stan all offer parental controls which can restrict the content that your kids can view. It’s definitely worth the effort.  

 

The post Five Ways To Protect Your Kids From Inappropriate Online Content appeared first on McAfee Blog.

Read More

chromium-120.0.6099.109-1.fc39

Read Time:24 Second

FEDORA-2023-1fe02ca797

Packages in this update:

chromium-120.0.6099.109-1.fc39

Update description:

update to 120.0.6099.109

– High CVE-2023-6702: Type Confusion in V8
– High CVE-2023-6703: Use after free in Blink
– High CVE-2023-6704: Use after free in libavif
– High CVE-2023-6705: Use after free in WebRTC
– High CVE-2023-6706: Use after free in FedCM
– Medium CVE-2023-6707: Use after free in CSS

Update to 120.0.6099.71

Read More

USN-6548-3: Linux kernel (Oracle) vulnerabilities

Read Time:2 Minute, 18 Second

It was discovered that Spectre-BHB mitigations were missing for Ampere
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2023-3006)

It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did
not properly validate u32 packets content, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate SCTP data, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in
the Linux kernel did not properly handle state filters, leading to an out-
of-bounds read vulnerability. A privileged local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-39194)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)

It was discovered that the TLS subsystem in the Linux kernel did not
properly perform cryptographic operations in some situations, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-6176)

Read More

USN-6549-3: Linux kernel (Low Latency) vulnerabilities

Read Time:2 Minute, 38 Second

It was discovered that the USB subsystem in the Linux kernel contained a
race condition while handling device descriptors in certain situations,
leading to a out-of-bounds read vulnerability. A local attacker could
possibly use this to cause a denial of service (system crash).
(CVE-2023-37453)

Lin Ma discovered that the Netlink Transformation (XFRM) subsystem in the
Linux kernel did not properly initialize a policy data structure, leading
to an out-of-bounds vulnerability. A local privileged attacker could use
this to cause a denial of service (system crash) or possibly expose
sensitive information (kernel memory). (CVE-2023-3773)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate some attributes passed from userspace. A local
attacker could use this to cause a denial of service (system crash) or
possibly expose sensitive information (kernel memory). (CVE-2023-39189)

Sunjoo Park discovered that the netfilter subsystem in the Linux kernel did
not properly validate u32 packets content, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39192)

Lucas Leong discovered that the netfilter subsystem in the Linux kernel did
not properly validate SCTP data, leading to an out-of-bounds read
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly expose sensitive information. (CVE-2023-39193)

Lucas Leong discovered that the Netlink Transformation (XFRM) subsystem in
the Linux kernel did not properly handle state filters, leading to an out-
of-bounds read vulnerability. A privileged local attacker could use this to
cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-39194)

It was discovered that a race condition existed in QXL virtual GPU driver
in the Linux kernel, leading to a use after free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-39198)

Kyle Zeng discovered that the IPv4 implementation in the Linux kernel did
not properly handle socket buffers (skb) when performing IP routing in
certain circumstances, leading to a null pointer dereference vulnerability.
A privileged attacker could use this to cause a denial of service (system
crash). (CVE-2023-42754)

Jason Wang discovered that the virtio ring implementation in the Linux
kernel did not properly handle iov buffers in some situations. A local
attacker in a guest VM could use this to cause a denial of service (host
system crash). (CVE-2023-5158)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel
did not properly handle queue initialization failures in certain
situations, leading to a use-after-free vulnerability. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5178)

Budimir Markovic discovered that the perf subsystem in the Linux kernel did
not properly handle event groups, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-5717)

Read More