Security Vulnerabilities - Page 4

Discover Security Vulnerabilities News

Hackers' Backdoor: Warning of New Linux Kernel Vulnerability

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

Vulnerabilities in the Linux kernel are an unfortunate reality of open-source software, as no code is ever perfect. While the open-source community overall does an excellent job finding and patching bugs, zero days will occasionally slip through. Recently, security researchers discovered yet another local privilege escalation vulnerability that impacts all versions of the Linux kernel.

Brittany Day
Feb 11, 2024

Zero-Click Bluetooth Attacks Pose Serious Threat Across Major OSes

Vulnerabilities have been discovered in Bluetooth technology that affect various operating systems. As Linux admins, infosec professionals, Internet security enthusiasts, and sysadmins, it is crucial to understand the implications of these vulnerabilities and the impact they may have on our work. Let's have a closer look at these flaws, how they work, their impact on Linux users, and how to mitigate your risk.

Brittany Day
Jan 14, 2024

Debian and Ubuntu Fix More OpenSSH Vulnerabilities

In the wake of the infamous “Terrapin vulnerability,” which allows a man-in-the-middle (MITM) attacker to access impacted users’ sensitive information in transit, Debian and Ubuntu have released security updates addressing five OpenSSH flaws. Let's explore the intricacies of these vulnerabilities, how they work, and recommended measures to fortify your OpenSSH environment.

Brittany Day
Jan 09, 2024

SSH Under Siege: Decoding the Terrapin Attack

Researchers recently uncovered a sophisticated attack dubbed Terrapin that takes advantage of a weakness in the SSH protocol to gain access to servers. The attack targets a specific implementation issue in OpenSSH 7.2 through 8.8 that allows remote code execution. By sending carefully crafted data, attackers can overflow the stack buffer and execute commands, leading to complete server compromise.

Brittany Day
Jan 02, 2024

Ansible Vulnerability Opens Door to Sensitive Data Leaks

Ansible is a widely used open-source configuration management and automation tool popular among Linux system administrators. A vulnerability recently disclosed in Ansible could allow attackers to access sensitive information on servers Ansible manages. This is a serious issue that Linux admins and IT teams need to take action on.

Brittany Day
Jan 01, 2024

Remotely Exploitable HAProxy Vuln Threatens Sensitive Data

It was discovered that the HAProxy load balancing reverse proxy incorrectly handled URI components containing the hash character (CVE-2023-45539). This vulnerability is very straightforward for a remote attacker to exploit and severely threatens impacted users’ sensitive information, making it among the worst bugs we’ve seen in a while!

Brittany Day
Dec 31, 2023

Severe Chromium Bug Threatens Sensitive Data, System Availability

A severe use-after-free vulnerability has been found in Chromium (CVE-2023-5472), which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability, which Chromium has rated as “high-severity”, is related to a bug in the webRTC (Real-time Communication) functionality.

Brittany Day
Dec 14, 2023

Critical Bluetooth Flaw Exposes Android, Apple & Linux Devices to Takeover

A newly discovered vulnerability in Bluetooth affects Android, Apple, and Linux devices and could be used to inject keystrokes into devices using a man-in-the-middle attack.

Brittany Day
Dec 07, 2023

LockBit Ransomware Exploiting Critical Citrix Bleed Vulnerability to Break In

LockBit ransomware is exploiting a critical Citrix bleed vulnerability to break into enterprise networks. The malware spreads via infected USB sticks and allows hackers to steal data and install more malware.

Brittany Day
Nov 25, 2023

Widespread Xorg DoS, Privilege Escalation Vulns Fixed

Several vulnerabilities have been found in the widely used Xorg X server, the most severe being an out-of-bounds write flaw due to an incorrect calculation of a buffer offset (CVE-2023-5367). Due to how easy this vulnerability is to exploit and its significant threat to the confidentiality, integrity, and availability of impacted systems, this bug has received a National Vulnerability Database base score of 7.8 out of 10 (“High” severity).

Brittany Day
Nov 13, 2023

Beyond the Buffer: Understanding the New Curl Bug and Steps to Secure Your System

The Curl application is a tool many software programs use to transmit various types of data to and from servers. It's essentially a workhorse allowing the other programs on your computer to communicate with the internet in a standard and efficient manner.

Brittany Day
Nov 02, 2023

Severe Poppler DoS Flaw Fixed

Uncontrolled Recursion has been discovered in pdfinfo and pdftops in version 0.89.0 of the Poppler PDF rendering library (CVE-2020-23804). This severe stack overflow vulnerability, which has received a National Vulnerability Database base score of 7.5 out of 10, significantly threatens the availability of impacted systems.

Brittany Day
Oct 25, 2023

Severe Chromium DoS, Info Disclosure Vulns Fixed

A severe, remotely exploitable Type Confusion vulnerability has been found in Chromium (CVE-2023-5346). Due to its significant threat to the confidentiality, integrity, and availability of impacted systems, this bug has received a National Vulnerability Database base score of 8.8 out of 10 (“High” severity).

Brittany Day
Oct 25, 2023

CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc’s ld.so

A notorious buffer overflow vulnerability dubbed “Looney Tunables” was recently found in the GNU C Library. This severe bug exists in the glibc dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable (CVE-2023-4911). This vulnerability was introduced in April 2021 and poses a significant threat to systems with default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13.

Brittany Day
Oct 19, 2023

Here's What You Need to Know about the Upcoming Curl Security Patches

Developers behind the open source library described one Curl vulnerability as one of the worst they've ever encountered.

Brittany Day
Oct 10, 2023

Critical Exim RCE, Info Disclosure Bugs Fixed

Three critical security vulnerabilities have been discovered in the widely-used Exim open-source email transfer agent, including a NTLM challenge out-of-bounds read information disclosure bug (CVE-2023-42114), a AUTH out-of-bounds write remote code execution (RCE) vulnerability (CVE-2023-42115), and a SMTP challenge stack-based buffer overflow RCE flaw (CVE-2023-42116).

Brittany Day
Oct 08, 2023

Critical Node.js Info Disclosure, Code Execution Bugs Fixed

Several significant security issues were fixed in Node.js, including two critical vulnerabilities that have received a National Vulnerability Database base score of 9.8 out of 10. CVE-2019-15605 is an HTTP request smuggling bug in Node.js 10, 12, and 13 that causes malicious payload delivery when transfer-encoding is malformed, and CVE-2019-15606 is an authorization bypass issue in Nodejs 10, 12, and 13.

Brittany Day
Oct 05, 2023

Critical Zero-Day Heap Buffer Overflow Vuln Fixed in Firefox, Thunderbird

A critical zero-day vulnerability that has been exploited in the wild was discovered in Firefox and Thunderbird. This severe bug, CVE-2023-4863, is a heap buffer overflow flaw in the WebP image format.

Brittany Day
Oct 05, 2023

Mitigations for Critical c-ares DoS, Code Execution Bug Released

A critical buffer overflow vulnerability has been found in c-ares before 1_16_1 thru 1_17_0 via the function ares_parse_soa_reply in ares_parse_soa_reply.c (CVE-2020-22217). Due to how simple this bug is to exploit and its significant threat to the confidentiality, integrity, and availability of impacted systems, it has received a National Vulnerability Database base score of 9.8 out of 10 (“Critical” severity).

Brittany Day
Sep 29, 2023

Critical OpenDMARC DoS Bug Fixed

A critical vulnerability was found in the OpenDMARC open-source implementation of the DMARC specification. It was discovered that OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 incorrectly handled certain inputs, resulting in remote memory corruption in certain situations (CVE-2020-12460). This vulnerability has received a National Vulnerability Database base score of 9.8 out of 10 (“Critical” severity).

Brittany Day
Sep 22, 2023

Security Vulnerabilities - Page 4

Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns

Easily Exploitable 10-Year-Old needrestart Utility Flaws Allow Root Access

7-Zip Users Beware: Urgent Update Needed to Fix Code Execution Security Flaw