Read Time:3 Second
Long article on the colossal squid.
Daily Archives: February 7, 2025
bind-9.18.33-1.fc42 bind-dyndb-ldap-11.11-2.fc42
Read Time:34 Second
FEDORA-2025-8033aca0a2
Packages in this update:
bind-9.18.33-1.fc42
bind-dyndb-ldap-11.11-2.fc42
Update description:
Update to 9.16.33 (rhbz#2342784)
Security Fixes:
DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
Limit additional section processing for large RDATA sets. (CVE-2024-11187)
New Features:
Add a new option to configure the maximum number of outgoing queries per client request.
Bug Fixes:
Fix nsupdate hang when processing a large update.
Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
Fix improper handling of unknown directives in resolv.conf.
libheif-1.19.5-3.fc41
Read Time:30 Second
FEDORA-2025-8fdb7be3cb
Packages in this update:
libheif-1.19.5-3.fc41
Update description:
Latest upstream release. It adds support for tiles and fixes reading images generated by iOS 18+. See https://github.com/strukturag/libheif/releases for more details about the changes since 1.17.6.
NOTE: heif-convert tool was renamed to heif-dec.
How to test:
Download and unzip sample images from mastodon issue #31570. Try opening them with e.g. loupe or gimp. They fail to open with libheif-1.17.6, but should open successfully with libheif-1.19.5.
Fixes CVE-2024-41311 .
libheif-1.19.5-3.fc40
Read Time:30 Second
FEDORA-2025-666aaa6a0d
Packages in this update:
libheif-1.19.5-3.fc40
Update description:
Latest upstream release. It adds support for tiles and fixes reading images generated by iOS 18+. See https://github.com/strukturag/libheif/releases for more details about the changes since 1.17.6.
NOTE: heif-convert tool was renamed to heif-dec.
How to test:
Download and unzip sample images from mastodon issue #31570. Try opening them with e.g. loupe or gimp. They fail to open with libheif-1.17.6, but should open successfully with libheif-1.19.5.
Fixes CVE-2024-41311 .
bind-9.18.33-1.fc43 bind-dyndb-ldap-11.11-2.fc43
Read Time:34 Second
FEDORA-2025-4133095c61
Packages in this update:
bind-9.18.33-1.fc43
bind-dyndb-ldap-11.11-2.fc43
Update description:
Update to 9.16.33 (rhbz#2342784)
Security Fixes:
DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
Limit additional section processing for large RDATA sets. (CVE-2024-11187)
New Features:
Add a new option to configure the maximum number of outgoing queries per client request.
Bug Fixes:
Fix nsupdate hang when processing a large update.
Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
Fix improper handling of unknown directives in resolv.conf.
Most UK GDPR Enforcement Actions Targeted Public Sector in 2024
Read Time:6 Second
27 UK public sector organizations faced ICO enforcement actions in 2024, with three fines issued, according to URM Consulting
Secret Taliban records published online after hackers breach computer systems
Read Time:13 Second
The Taliban government of Afghanistan is reeling after unidentified hackers successfully carried out a massive cyber attack against its computer systems and published over 50GB of stolen documents and files online.
Read more in my article on the Hot for Security blog.
Screenshot-Reading Malware
Read Time:25 Second
Kaspersky is reporting on a new type of smartphone malware.
The malware in question uses optical character recognition (OCR) to review a device’s photo library, seeking screenshots of recovery phrases for crypto wallets. Based on their assessment, infected Google Play apps have been downloaded more than 242,000 times. Kaspersky says: “This is the first known case of an app infected with OCR spyware being found in Apple’s official app marketplace.”
That’s a tactic I have not heard of before.
Malicious AI Models on Hugging Face Exploit Novel Attack Technique
Read Time:6 Second
The technique, called nullifAI, allows the models to bypass Hugging Face’s protective measures against malicious AI models
Third-Party Risk Management Failures Expose UK Finance Sector
Read Time:8 Second
Orange Cyberdefense found that over half of UK financial firms suffered at least one third-party attack in 2024, linked to significant gaps in risk management strategies