Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
SciLinux: SLSA-2022-8552-1 Important: firefox on SL7.x x86_64
This update upgrades Firefox to version 102.5.0 ESR. * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403) * Mozilla:…
Debian LTS: DLA-3137-1: nodejs security update
Multiple vulnerabilities were discovered in Node.js, a JavaScript runtime environment, which could result in memory corruption, invalid certificate validation,…
SciLinux: SLSA-2022-5480-1 Important: thunderbird on SL7.x x86_64
This update upgrades Thunderbird to version 91.11. * Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-20…
SciLinux: SLSA-2022-5479-1 Important: firefox on SL7.x x86_64
This update upgrades Firefox to version 91.11 ESR. * Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-20…
Mageia 2022-0207: firefox/thunderbird security update
Prototype pollution in Top-Level Await implementation. (CVE-2022-1802) Untrusted input used in JavaScript object indexing, leading to prototype pollution. (CVE…
SciLinux: SLSA-2022-4729-1 Critical: firefox on SL7.x x86_
This update upgrades Firefox to version 91.9.1 ESR. * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution (CVE-2022-152…
SciLinux: SLSA-2022-4729-1 Critical: firefox on SL7.x x86_64
This update upgrades Firefox to version 91.9.1 ESR. * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution (CVE-2022-152…
SciLinux: SLSA-2022-4730-1 Critical: thunderbird on SL7.x x86_
This update upgrades Thunderbird to version 91.9.1. * Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution (CVE-2022-152…
Ubuntu 5434-1: Firefox vulnerabiliti
Firefox could be made to execute JavaScript in a privileged context if it opened a malicious website.
Debian LTS: DLA-2980-1: zabbix security upda
Several security vulnerabilities have been discovered in zabbix, a network monitoring solution. An authenticated user can create a link with reflected Javascri…
Mageia 2022-0059: webkit2 security upda
Processing a maliciously crafted mail message may lead to running arbitrary javascript. Description: A validation issue was addressed with improved input sanit…
New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability
Cybersecurity researchers have discovered an entirely new attack vector that enables adversaries to exploit the Log4Shell vulnerability on servers locally by u…
Update Google Chrome to Patch 2 New Zero-Day Flaws Under Attack
Google on Monday released security updates for Chrome web browser to address a total of 11 security issues, two of which it says are actively exploited zero-da…
F5 Releases Critical Security Patch for BIG-IP and BIG-IQ Devices
Enterprise security and network appliance vendor F5 has released patches for more thanÂtwo dozen security vulnerabilitiesÂaffecting multiple versions of BIG-IP…
F5 Releases Critical Security Patches for BIG-IP and BIG-IQ Devices
Enterprise security and network appliance vendor F5 has released patches for more thanÂtwo dozen security vulnerabilitiesÂaffecting multiple versions of BIG-IP…
Update Your Chrome Browser to Patch 2 New In-the-Wild 0-Day Exploits
Google on Tuesday released a new version of Chrome web-browsing software for Windows, Mac, and Linux with patches for two newly discovered security vulnerabili…
2 New Chrome 0-Days Under Attack ' Update Your Browser ASAP!
Google on Tuesday released a new version of Chrome web-browsing software for Windows, Mac, and Linux with fixes for two security vulnerabilities, both of which…
New PIN Verification Bypass Flaw Affects Visa Contactless Payments
Even as Visa issued a warning about a new JavaScript web skimmer known as Baka, cybersecurity researchers have uncovered an authentication flaw in the company'…
Fedora 31: php-horde-horde FEDORA-2020-01d7b8b6
**horde 5.2.23** * [mjr] SECURITY: Fix javascript injection vulnerability in mobile login page. * [mjr] Fix broken cloud search in portal block.
Fedora 32: php-horde-horde FEDORA-2020-a41fda3b
**horde 5.2.23** * [mjr] SECURITY: Fix javascript injection vulnerability in mobile login page. * [mjr] Fix broken cloud search in portal block.
SciLinux: SLSA-2020-2615-1 Important: thunderbird on SL7.x x86_
Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage (CVE-2020-12398) * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405) …
SciLinux: SLSA-2020-2613-1 Important: thunderbird on SL6.x i386/x86_
Mozilla: Security downgrade with IMAP STARTTLS leads to information leakage (CVE-2020-12398) * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405) …
Debian LTS: DLA-2230-1: php-horde security upda
The image view functionality in Horde Groupware Webmail Edition was affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload conta…
Debian LTS: DLA-2149-1: rails security upda
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.