Resolved Bugs
1217282 – libtasn1-4.5 is available
1218141 – CVE-2015-3622 libtasn1: heap overflow flaw in _asn1_extract_der_octet()
1218142 – CVE-2015-3622 libtasn1: heap overflow flaw in _asn1_extract_der_octet() [fedora-all]<br
Update to 4.5 (#1217282)
Monthly Archives: May 2015
Fedora 21 Security Update: texlive-2014-7.1.20140525_r34255.fc21
CVE-2015-0532 (rsa_identity_management_and_governance)
EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account.
CVE-2015-0712 (staros)
The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets, aka Bug ID CSCud14217.
CVE-2015-0912 (easyctf)
EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
CVE-2015-0913
Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-0914 (easyctf)
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
CVE-2015-1243 (chrome)
Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered.
CVE-2015-1250
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Three reasons to be excited about: Mobile Payments
While paying through a mobile device, wearable or digital card may seem like a high-tech near future, the reality is that mobile payments are already soaring around the globe.
Earlier in April, GSMA Mobile Money for the Unbanked (MMU) released its 2014 State of the Industry Report on mobile financial services. The report indicates that there are already 255 mobile money services in operation across 89 countries and in over 60% of developing markets.
The arrival of major tech and finance players such as Apple, VISA and Samsung have brought the mobile payments into the spotlight and into the mainstream.
Here we look at three of the most interesting developments in recent months:
Digital Credit Cards
While generally still in the beta phase, digital credit cards promise to consolidate the bulk of a wallet or purse into a single card.
The idea is to forgo multiple cards and instead have a single digital card that can be programmed with the details of all your other payment and membership cards. At the touch of a button, your American Express card can become your Starbucks loyalty card. Pretty neat!
There are several major players in this space including Coin, Plastc, Swyp and Wocket.
Mobile payments are getting full backing
There’s recently been some good news for those worried about storing money in online services such as Apple Pay, PayPal or Google Wallet.
According to Yahoo Finance, the Feder Deposit Insurance Corporation (FDIC) now insures funds stored in Google Wallet.
This means that should anything happen to Google or one of the banks holding your money, your digitally stored funds are protected by the US federal government.
While most of us use services such as PayPal to directly make payments rather than actually store money, it’s reassuring to know that online digital balances are starting to get the same government protection offered to the traditional banking system.
Mobile payments are going social
One of the most interesting developments in the mobile payment space has been the land grab by several social networks to integrate payment services into their platforms. Both Facebook and Snapchat have both got involved.
The rise of dedicated social payment services is also worth noting. Payment service Venmo has already risen to prominence (although not with a few security hiccups on the way).
I personally see social and banking as two diametrically opposed services. One should be private, secure and personal, the other open public and shared.
The fact of the matter is that there’s clearly a demand for a payment protocol with inbuilt social features so expect to see a whole lot more activity in this area in the coming months.
