New upstream – 37.0.2
Monthly Archives: April 2015
Fedora 22 Security Update: xulrunner-37.0.2-1.fc22,firefox-37.0.2-2.fc22
Resolved Bugs
1210474 – Update fedora-bookmarks for Fedora 22<br
Update to new upstream – 37.0.2
Bookmark rebuild – Bug 1210474
Fedora 22 Security Update: xen-4.5.0-8.fc22
Fedora 20 Security Update: qt3-3.3.8b-63.fc20
Resolved Bugs
1210675 – CVE-2015-1860 qt: segmentation fault in qgifhandler.cpp<br
This update fixes CVE-2015-1860, a buffer overflow when loading some specific invalid GIF image files, which could be exploited for denial of service (application crash) and possibly even arbitrary code execution attacks. The security patch is backported from Qt 4.
(Please note that Qt 3 is NOT vulnerable to the simultaneously published issues CVE-2015-1858 and CVE-2015-1859.)
Fedora 20 Security Update: xen-4.3.4-3.fc20
Hackers spy on Kansas family through unsecured baby monitor
A Kansas family are the latest victims of a hacked nanny cam, after noticing the device purchased to monitor their three-month-old baby was also monitoring them.
The post Hackers spy on Kansas family through unsecured baby monitor appeared first on We Live Security.
![]()
‘Fully Secure Systems Don’t Exist’
SAN FRANCISCO–The more things change, the more they stay the same. Thirty years ago, Adi Shamir, one of the inventors of the RSA algorithm, was asked to do a keynote speech at a conference and spoke about his laws of computer security. They were a set of principles that he developed over the years relating […]
When Minecraft Meets IT Security

The phenomenon that is Minecraft began life back in 2009 as a sandbox construction game and has grown into one of the most popular games in history with hundreds of millions of players all over the world interacting via computers, consoles and mobile devices – there is even a dedicated version for the Raspberry Pi where programmers are encouraged to modify the game code for educational purposes.
Video game merchandise based around the Minecraft world tops the UK charts for sales in 2014 and over 2 million Minecraft books were sold in the UK last year.
The fan-base have created extraordinary objects and landscapes including a 1:25 scale Ordnance Survey map of the UK, a working 16-bit computer and a plan for a life size model of the British Museum is underway.
There are YouTube channels dedicated solely to Minecraft and top vloggers such as Stampy (@stampylongnose) who dedicate their lives making Minecraft adventures to show their millions of followers – with nearly 4 billion Minecraft videos viewed on YouTube every month.
The beginning of a single-player game of Minecraft is ensuring your character ‘Steve’ survives after being dropped alone into a digital world with empty pockets. ‘Steve’ must mine the resources needed to build a home and craft tools to protect him against the monsters which come out in the dark.

This process parallels the need to protect a new computer or mobile device before it is exposed to cyberthreats – the very first thing you should do is gather security resources and craft them into protective walls and tools against the ‘monsters’ from the dark side of the Internet.
Minecraft users are well aware of these threats as recently an unpatched vulnerability, first reported to Mojang in July 2013, was published allowing Minecraft servers to be crashed
Back in January 2015 nearly two thousand Minecraft users had their login credentials leaked online with the hackers stating they had many more. How the hackers obtained the credentials is unknown with possibilities ranging from blunt force (zombie mob) guessing of credentials, targeted phishing attacks (skeletons), or even a security breach (Ender Dragon) at Mojang itself – something which the Microsoft owned software developer has since denied.
Other monsters and environmental dangers within Minecraft are also analogous to the various types of cyberthreats including:
- Pervasive Creepers are the explosive old-skool malware simply out to cause destruction.
- Pools of lava and rock falls can appear at any time while mining just as a drive-by vulnerability of a compromised website can infect your device while browsing.
- Falling into a pool of lava will not only kill you, but also cause the loss of all the precious objects and clothing being carried – ensure you back up your important files to provide extra security against destructive malware and ransomware.
- Dual threats come from Spider Jockeys similar to a vulnerability allowing malware to silently infiltrate the computer – the vulnerability must be patched and the malware cleaned to ensure enemy is vanquished.
- The largest and most complex Minecraft threat is the Ender Dragon which uses a multitude of attack methods similar to modern Advanced Persistent Threats (APTs) – only a layered security approach, user vigilance and auditing tools (or a very heavily armed ‘Steve’) can mitigate.
Luckily there are numerous security tools that can stop these monstrous problems interfering with the smooth-running of your digital life:
- The Antivirus and firewall are your house and walls stopping the majority of everyday threats.
- Proactive cloud-based detection is your armour protecting you wherever you go against new and unknown threats from all directions.
- Specific security tools are your sword, pick and shovel in the forms of virtual keyboards, application control and USB vaccines.
- If you are lost within the labyrinth of caverns then Mobile Device Locators are your map and compass, and antitheft may restore your resources when stolen by monsters.
- A lightweight security solution which protects without impacting on your device performance will allow you to carry all you want – Imagine discovering a huge seam of diamonds without being able to carry an iron pickaxe as your pack is full software bloat.
Panda Security offer a variety of free and paid for solutions for consumers and businesses to protect you against the cyberthreats visit Panda Security for details.
Neil Martin – Head of Marketing at the UK & Ireland arm of Panda Security
The post When Minecraft Meets IT Security appeared first on MediaCenter Panda Security.
Node Template – Moderately Critical – Cross Site Scripting (XSS) – Unsupported – SA-CONTRIB-2015-099
- Advisory ID: DRUPAL-SA-CONTRIB-2015-099
- Project: Node Template (third-party module)
- Version: 6.x, 7.x
- Date: 2015-April-22
- Security risk: 12/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default
- Vulnerability: Cross Site Request Forgery
Description
Node Template module enables you to define any node as a node template and it can be duplicated later.
The module doesn’t sufficiently protect some URLs against CSRF. A malicious user can cause a user with “access node template” permission to delete node templates by getting their browser to make a request to a specially-crafted URL.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
All versions of Node Template module.
Drupal core is not affected. If you do not use the contributed Node Template module, there is nothing you need to do.
Solution
If you use the Node Template module you should uninstall it.
Also see the Node Template project page.
Reported by
- Pere Orga of the Drupal Security Team
Fixed by
Not applicable.
Coordinated by
- Pere Orga of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Keyword Research – Moderately Critical – Cross Site Request Forgery (CSRF) – SA-CONTRIB-2015-098
- Advisory ID: DRUPAL-SA-CONTRIB-2015-098
- Project: Keyword Research (third-party module)
- Version: 6.x
- Date: 2015-April-22
- Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
- Vulnerability: Cross Site Request Forgery
Description
Keyword Research module enables you to tag and prioritize keywords on a site and node level basis.
The module doesn’t sufficiently protect some URLs against CSRF. A malicious user can cause another user with “kwresearch admin site keywords” permission to create, delete and set priorities to keywords by getting their browser to make a request to a specially-crafted URL.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Keyword Research 6.x-1.x versions prior to 6.x-1.2.
Drupal core is not affected. If you do not use the contributed Keyword Research module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Keyword Research module for Drupal 6.x, upgrade to Keyword Research 6.x-1.2
Also see the Keyword Research project page.
Reported by
- Pere Orga of the Drupal Security Team
Fixed by
- Tom McCracken the module maintainer
Coordinated by
- Pere Orga of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity