An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.
saitoha libsixel v1.8.6 was discovered to contain a double free via the component sixel_chunk_destroy at /root/libsixel/src/chunk.c.
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
Information Leak Vulnerability exists in the Xiaomi Router AX6000. The vulnerability is caused by incorrect routing configuration. Attackers can exploit this vulnerability to download part of the files in Xiaomi Router AX6000.
A command injection vulnerability exists in the Xiaomi Router AX3600. The vulnerability is caused by a lack of inspection for incoming data detection. Attackers can exploit this vulnerability to execute code.
annobin-10.57-3.fc36
firefox-98.0-2.fc36
gcc-12.0.1-0.12.fc36
This update provides the latest release of Firefox, with many bug fixes including critical security issues. It also includes updates to gcc and annobin which were necessary to build Firefox, with the following fixes:
fix up promoted SUBREG handling (#2045160, PR rtl-optimization/104839)
fix up check for asm goto (PR rtl-optimization/104777)
Upstream bugs (http://gcc.gnu.org/PRNNNNN) fixed: 70077, 79493, 80270, 84519, 87496, 88134, 90148, 91384, 96526, 99297, 99555, 99585, 100400, 100407, 100541, 100757, 101325, 101636, 101983, 102276, 102429, 103037, 103302, 103443, 103521, 103836, 103845, 103856, 103984, 104061, 104121, 104131, 104132, 104133, 104154, 104208, 104381, 104430, 104434, 104489, 104529, 104533, 104540, 104550, 104552, 104558, 104573, 104589, 104601, 104602, 104618, 104619, 104627, 104633, 104637, 104644, 104648, 104656, 104659, 104664, 104667, 104674, 104675, 104676, 104677, 104679, 104681, 104682, 104686, 104687, 104698, 104700, 104704, 104715, 104716, 104721, 104724, 104725, 104726, 104727, 104728, 104730, 104732, 104736, 104748, 104757, 104758, 104761, 104775, 104779, 104781, 104782, 104784, 104791, 104794, 104797, 104807, 104825, 104838
openexr-3.1.4-1.fc36
New upstream release 3.1.4
openexr-3.1.4-1.fc35
New upstream release 3.1.4
USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it
caused a regression and an additional patch was required. This update address
this regression and several other vulnerabilities.
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-25313)
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-25315)
Original advisory details:
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2022-25236)
FortiGuard Labs is aware that the U.S. Federal Bureau of Investigation (FBI) released the updated indicators of compromise (IOCs) for RagnarLocker (Ragnar_Locker) Ransomware on March 8th, 2022. The report states “As of January 2022, the FBI has identified at least 52 entities across 10 critical infrastructure sectors affected by RagnarLocker ransomware, including entities in the critical manufacturing, energy, financial services, government, and information technology sectors.”The first sighting of the ransomware goes back to at least February, 2020. RagnarLocker ransomware employs triple extortion tactics: it demands ransom after encrypting files, threatens to publicize stolen data and to stop DDoS (Distributed Denial of Service) attack against the victim.Why is this Significant?This is significant because the FBI is aware that more than 50 organizations across 10 critical infrastructure sectors were affected by RagnarLocker ransomware. The fact the FBI has made additional IOCs available to the public insinuates that RagnarLocker will continue to be active and will likely produce more victims.What is RagnarLocker Ransomware?The first report of RagnarLocker (Ragnar_Locker) ransomware dates back to as early as February 2020.Just like any other ransomware, RagnarLocker encrypts files on the compromised machine and steals valuable data. It also deletes all Volume Shadow Copies, which prevents recovery of the encrypted files. Although there are some exceptions, files encrypted by RagnarLocker ransomware generally have a file extension that starts with .ragnar_ or ragn@r_ followed by random characters.On top of usual ransom demand to decrypt the files it encrypted, the ransomware threatens to publicize the data it stole from the victim if the ransom demand is not met. The RagnarLocker threat actors also adds pressure to the victim to pay the ransom by performing DDoS (Distributed Denial of Service) attack against the victim.One notable thing about this ransomware is that it has code to check the location of the computer before encryption process starts. If the computer belongs Russia, Azerbaijan, Armenia, Belarus, Georgia, Kazakhstan, Kyrgyzstan, Moldova, Tajikistan, Turkmenistan, Uzbekistan and Ukraine, the ransomware terminates itself. What are the Mitigations for RagnarLocker Ransomware?The following are the mitigations recommended by FBI:Back-up critical data offline.Ensure copies of critical data are in the cloud or on an external hard drive or storage device. This information should not be accessible from the compromised network.Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the data resides.Use multi-factor authentication with strong passwords, including for remote access services.Keep computers, devices, and applications patched and up-to-date.Monitor cyber threat reporting regarding the publication of compromised VPN login credentials and change passwords and settings.Consider adding an email banner to emails received from outside your organization.Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.Audit user accounts with administrative privileges and configure access controls with least privilege in mind.Implement network segmentation.What is the Status of Coverage?FortiGuard Labs provide the following AV coverage against RagnarLocker ransomware:Linux/Filecoder_RagnarLocker.A!trW32/RagnarLocker.43B7!tr.ransomW32/Filecoder_RagnarLocker.A!trW32/RagnarLocker.A!tr.ransomW32/RagnarLocker.C!trW32/RagnarLocker.B!tr.ransomW32/RagnarLocker.4C9D!tr.ransomW32/Filecoder_RagnarLocker.A!tr.ransomW32/RagnarLocker.C!tr.ransomW32/Filecoder_RagnarLocker.C!trW32/Filecoder.94BA!tr.ransomW32/Filecoder.OAH!tr.ransomAll network IOCs are blocked by the WebFiltering client.
