Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
HolesWarm Malware Exploits Unpatched Windows, Linux Servers
The HolesWarm botnet cryptominer has already compromised 1,000-plus clouds since June.
SciLinux: SLSA-2021-3176-1 Important: microcode_ctl
hw: Vector Register Data Sampling (CVE-2020-0548) * hw: L1D Cache Eviction Sampling (CVE-2020-0549) * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-20…
Debian: DSA-4953-1: lynx security upda
Thorsten Glaser and Axel Beckert reported that lynx, a non-graphical (text-mode) web browser, does not properly handle the userinfo subcomponent of a URI, whic…
Fedora 33: mosquitto 2021-2ab613b4
Update to 1.6.15 Security If an authenticated client connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur. Affects ver…
Debian: DSA-4931-1: xen security upda
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service or information leaks. For the stable distribution …
Debian LTS: DLA-2664-1: curl security upda
Viktor Szakats reported that libcurl, an URL transfer library, does not strip off user credentials from the URL when automatically populating the Referer HTTP …
Fedora 32: openvpn 2021-d6b9d849
Security update - OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured w…
Fedora 32: curl 2021-26a293c7
- fix TLS 1.3 session ticket proxy host mixup (CVE-2021-22890) - prevent automatic referer from leaking credentials (CVE-2021-22876)
Fedora 33: curl 2021-cab5c9be
- fix TLS 1.3 session ticket proxy host mixup (CVE-2021-22890) - prevent automatic referer from leaking credentials (CVE-2021-22876)
Fedora 31: php 2020-94763cb9
**PHP version 7.3.23** (01 Oct 2020) **Core:** * Fixed bug php#80048 (Bug php#69100 has not been fixed for Windows). (cmb) * Fixed bug php#80049 (Memleak when …
Debian: DSA-4769-1: xen security upda
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information…
Ubuntu 4562-1: kramdown vulnerabili
kramdown could be made to crash, run programs, or leak sensitive information if it opened a specially crafted file.
Debian: DSA-4767-1: mediawiki security upda
Multiple security issues were discovered in MediaWiki, a website engine for collaborative work: SpecialUserRights could leak whether a user existed or not, mul…
Debian: DSA-4766-1: rails security upda
Multiple security issues were discovered in the Rails web framework which could result in cross-site scripting, information leaks, code execution, cross-site r…
Fedora 31: gnutls 2020-30cd8d9a
Update to the new upstream 3.6.15 release. ---- - Fix memory leak when serializing iovec_t (#1845083) - Fix automatic libraries sonames detection (#1845806)
Debian LTS: DLA-2359-1: xorg-server security upda
Several issues have been found in xorg-server, the X server from xorg. Basically all issues are out-of-bounds access or integer underflows in different request…
Debian LTS: DLA-2350-1: php-horde-kronolith security upda
In Horde Groupware, there has been an XSS via the Name field during creation of a new Resource. This could have been leveraged for remote code execution after …
Debian LTS: DLA-2338-1: proftpd-dfsg security upda
Several memory leaks were discovered in proftpd-dfsg, a versatile, virtual-hosting FTP daemon, when mod_facl or mod_sftp is used which could lead to memory exh…
SciLinux: SLSA-2020-3253-1 Important: firefox on SL7.x x86_
chromium-browser: Use after free in ANGLE (CVE-2020-6463) * chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514) * Mozilla: Potential leak …
SciLinux: SLSA-2020-3233-1 Important: firefox on SL6.x i386/x86_
chromium-browser: Use after free in ANGLE (CVE-2020-6463) * chromium-browser: Inappropriate implementation in WebRTC (CVE-2020-6514) * Mozilla: Potential leak …
Fedora 31: php-horde-kronolith 2020-0fbd043b
**kronolith 4.2.29** * [mjr] Fix regresssion in event modification notifications (Bug #15022). ---- **kronolith 4.2.28** * [mjr] **SECURITY**: Don't leak priva…
Fedora 32: php-horde-kronolith 2020-2f88bad8
**kronolith 4.2.29** * [mjr] Fix regresssion in event modification notifications (Bug #15022). ---- **kronolith 4.2.28** * [mjr] **SECURITY**: Don't leak priva…
SciLinux: SLSA-2020-2894-1 Important: dbus on SL7.x x86_
dbus: denial of service via file descriptor leak (CVE-2020-12049) SL7 x86_64 dbus-1.10.24-14.el7_8.x86_64.rpm dbus-debuginfo-1.10.24-14.el7_8.i686.rpm dbus-deb…
Debian: DSA-4723-1: xen security upda
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information…