Posts

Cybersecurity Updates For Week 10 of 2022

/in /by

Intel and Arm CPUs have a major security flaw

A new Spectre class speculative execution vulnerability, called Branch History Injection (BHI) or Spectre-BHB, was jointly disclosed on Tuesday by VUSec security research group and Intel.

Read more:
https://www.techspot.com/news/93706-arm-intel-cpus-vulnerable-new-spectre-style-attack.html

Microsoft tests new cloud-based Microsoft Defender for home users

Microsoft has announced that the company’s new cloud-based Microsoft Defender security solution has entered preview for home customers in the United States.

Read more:
https://www.bleepingcomputer.com/news/microsoft/microsoft-tests-new-cloud-based-microsoft-defender-for-home-users/

Mozilla fixes Firefox zero-days exploited in the wild (CVE-2022-26485, CVE-2022-26486)

Mozilla has released an out-of-band security update for Firefox, Firefox Focus, and Thunderbird, fixing two critical vulnerabilities (CVE-2022-26485, CVE-2022-26486) exploited by attackers in the wild.

Read More:
https://www.helpnetsecurity.com/2022/03/07/cve-2022-26485-cve-2022-26486/

Other news worth mentioning:

New Linux bug gives root on all major distros, exploit released
CVE-2022-26143: TP240PhoneHome Reflection/Amplification DDoS Attack Vector
Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March Patch Tuesday
Computer science professor takes a ‘hands-on’ approach to smartphone security

Mozilla – Miscellaneous memory safety hazards

/in /by

Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

This has been fixed in:
Firefox 24.0
Firefox ESR 17.0.9
Thunderbird 24.0
Thunderbird ESR 17.0.9
Seamonkey 2.21

More information: http://www.mozilla.org/security/announce/2013/mfsa2013-76.html

Mozilla releases security updates to multiple applications

/in , /by

Mozilla has released updates to some of their applications in order to correct some critical security issues.
It is recommended to upgrade as soon as possible to the versions below, should you be using any of them:
Firefox 20.0
Firefox ESR 17.0.5
Thunderbird 17.0.5
Thunderbird ESR 17.0.5
SeaMonkey 2.17

More information: http://www.mozilla.org/security/announce/

Mozilla Firefox / Thunderbird / SeaMonkey – Multiple Vulnerabilities

/in , /by

A weakness and multiple vulnerabilities have been reported in [Mozilla Firefox], Thunderbird and SeaMonkey, which can be exploited by malicious people to disclose potentially sensitive information, conduct spoofing attacks, bypass certain security restrictions, and compromise a user’s system.

The weakness and the vulnerabilities are reported in [Firefox versions prior to 19,] Thunderbird versions prior to 17.0.3 and SeaMonkey versions prior to 2.16.

These are marked as “Highly critical”, and it’s therefore suggested that you update your software as soon as possible.
You can find the updates here:
SeaMonkey: http://www.seamonkey-project.org/
Thunderbird: http://www.mozilla.org/en-US/thunderbird/
Firefox 19: Either simply go to Help, About in your browser to download the latest version if it didn’t already auto update, or visit http://www.mozilla.org/en-US/firefox/fx/#desktop

Firefox 19 also contains their all new built-in PDF reader, which means that both Chrome and Firefox now has built in PDF readers. Those wanting to secure themselves from last week’s Adobe Acrobat Reader vulnerability could therefore choose Firefox as the alternative as well.

More information:
http://secunia.com/advisories/52280/
http://secunia.com/advisories/52249/
http://secunia.com/advisories/52286/