Apple has released a security update stating that it has discovered the following vulnerabilities in the macOS High Sierra 10.13.5: a) Accessibility Framework – a malicious application may be able to execute arbitrary code with system privileges (CVE-2018-4196). b) AMD – a local user may be able to read kernel memory (CVE-2018-4253). c) Bluetooth – […]
Talos has reported that a sophisticated modular malware system known as VPNFilter has a destructive capability that can make the affected device unusable. Devices known to be affected by VPNFilter include Linksys, MikroTik, NETGEAR, and TP-Link networking equipment as well as QNAP network-attached storage (NAS) devices. In addition, compromised devices may be vulnerable to the […]
Cisco has released a security update stating that a vulnerability in Cisco Digital Network Architecture (DNA) Center which could allow an unauthenticated, remote attacker to log in to an affected system by using an administrative account that has default, static user credentials.This is due to the presence of undocumented, static user credentials for the default […]
Mozilla has released a security update stating that multiple vulnerabilities have been identified in Mozilla Thunderbird: a) Multiple memory corruption vulnerabilities which could result in arbitrary code execution – (CVE-2018-5150). b) A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially exploitable crash – (CVE-2018-5154). c) […]
The Internet Systems Consortium (ISC) has released a security update stating that A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c even when stale-answer-enable is off. Additionally, problematic interaction between the serve-stale feature and NSEC aggressive negative caching can in some cases cause […]
Microsoft has released a security update stating that multiple vulnerabilities have been discovered in Microsoft Office PowerPoint and Excel for Mac where an attacker could entice a victim to open a specially crafted file using the affected application where Microsoft Office PowerPoint and Excel for Mac fails to properly handle objects in memory. Details of […]
VMware has released a security update stating that VMware NSX SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks as successful exploitation of this issue could result in remote code execution. Further information on this […]
Mozilla has released a security update stating that the following vulnerabilities have been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR): a) A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension […]
Google has released a security update stating that the following vulnerabilities have been discovered in Google Chrome: a) Heap buffer overflow in PDFium – (CVE-2018-6120) b) Privilege escalation in extensions – (CVE-2018-6121) c) Type confusion in V8 – (CVE-2018-6122) d) Chain leading to sandbox escape Successful exploitation of the most severe of these vulnerabilities could […]
Microsoft has released a security update stating that vulnerabilities have been found in several of its products which could allow for remote code execution. Products affected include: 1) Microsoft Windows 7, 8, RT 8.1, and 10 2) Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016 3) Microsoft Windows Server Core Installation 2008, 2008 […]
