This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-5929.
Monthly Archives: June 2024
ZDI-24-819: VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-5930.
ZDI-24-820: Windscribe Directory Traversal Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-6141.
DSA-5717-1 php8.2 – security update
It was discovered that user validation was incorrectly implemented
for filter_var(FILTER_VALIDATE_URL).
Smashing Security podcast #377: An unhealthy data dump, railway surveillance, and a cheater sues Apple
There’s a wee data breach with unhealthy implications in Scotland, privacy has gone off the rails in the UK, and a cheater blames Apple for his expensive divorce.
All this and much more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Lianne Potter of the “Compromising Positions” podcast.
Plus don’t miss our featured interview with Abhishek Agrawal, CEO of Material Security.
New Blog Moderation Policy
There has been a lot of toxicity in the comments section of this blog. Recently, we’re having to delete more and more comments. Not just spam and off-topic comments, but also sniping and personal attacks. It’s gotten so bad that I need to do something.
My options are limited because I’m just one person, and this website is free, ad-free, and anonymous. I pay for a part-time moderator out of pocket; he isn’t able to constantly monitor comments. And I’m unwilling to require verified accounts.
So starting now, we will be pre-screening comments and letting through only those that 1) are on topic, 2) contribute to the discussion, and 3) don’t attack or insult anyone. The standard is not going to be “well, I guess this doesn’t technically quite break a rule,” but “is this actually contributing.”
Obviously, this is a subjective standard; sometimes good comments will accidentally get thrown out. And the delayed nature of the screening will result in less conversation and more disjointed comments. Those are costs, and they’re significant ones. But something has to be done, and I would like to try this before turning off all comments.
I am going to disable comments on the weekly squid posts. Topicality is too murky on an open thread, and these posts are especially hard to keep on top of.
Comments will be reviewed and published when possible, usually in the morning and evening. Sometimes it will take longer. Again, the moderator is part time, so please be patient.
I apologize to all those who have just kept commenting reasonably all along. But I’ve received three e-mails in the past couple of months about people who have given up on comments because of the toxicity.
So let’s see if this works. I’ve been able to maintain an anonymous comment section on this blog for almost twenty years. It’s kind of astounding that it’s worked as long as it has. Maybe its time is up.
chromium-126.0.6478.114-1.el7
FEDORA-EPEL-2024-40073a5fd9
Packages in this update:
chromium-126.0.6478.114-1.el7
Update description:
update to 126.0.6478.114
High CVE-2024-6100: Type Confusion in V8
High CVE-2024-6101: Inappropriate implementation in WebAssembly
High CVE-2024-6102: Out of bounds memory access in Dawn
High CVE-2024-6103: Use after free in Dawn
chromium-126.0.6478.114-1.el9
FEDORA-EPEL-2024-32c5029d69
Packages in this update:
chromium-126.0.6478.114-1.el9
Update description:
update to 126.0.6478.114
High CVE-2024-6100: Type Confusion in V8
High CVE-2024-6101: Inappropriate implementation in WebAssembly
High CVE-2024-6102: Out of bounds memory access in Dawn
High CVE-2024-6103: Use after free in Dawn
chromium-126.0.6478.114-1.el8
FEDORA-EPEL-2024-6b799a502a
Packages in this update:
chromium-126.0.6478.114-1.el8
Update description:
update to 126.0.6478.114
High CVE-2024-6100: Type Confusion in V8
High CVE-2024-6101: Inappropriate implementation in WebAssembly
High CVE-2024-6102: Out of bounds memory access in Dawn
High CVE-2024-6103: Use after free in Dawn
thunderbird-115.12.1-1.fc39
FEDORA-2024-6de8bb7c1b
Packages in this update:
thunderbird-115.12.1-1.fc39
Update description:
Update to 115.12.1
https://www.thunderbird.net/en-US/thunderbird/115.12.1/releasenotes/
https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/
Update to 115.12.0
https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/
https://www.thunderbird.net/en-US/thunderbird/115.12.0/releasenotes/