0day Mailbird XSS

Posted by Henri Salo on May 22

I created inquiry about this issue to their support and got two replies:

Leonardo Santoso, May 11, 12:50:
We are investigating this issue right now, I’ll let you know once we know more
about it. Thank you for notifying us about it.

Leonardo Santoso, May 21, 17:50: This issue should be fix in the latest version,
please update your Mailbird.

Latest version after downloading the application is 2.0.16.0 dated as May 15,
which is still…

Hue 3.7.1 Local Privilege Escalation

Posted by Henri Salo on May 22

Hue project responded in two different messages:

“””
This is not changed, the Hue project provides this command as a helper,

this is up to the packaging distribution to change the permissions of/move

the files accordingly.
“””

“””
Actually, the root…

SAP Security Notes May 2015

Posted by Darya Maenkova on May 22

SAP <http://www.sap.com/>has released the monthly critical patch update
for May 2015. This patch update closes a lot of vulnerabilities in SAP
products, some of them belong in the SAP HANA security area. This month,
three critical vulnerabilities found by ERPScan researchers Dmitry
Chastukhin and Vahagn Vardanyan were closed.

*Issues that were patched with the help of ERPScan*

The detailed list of corrected vulnerabilities that were…

Hacktivity 2015 CFP

Posted by Ferenc Spala on May 22

Hi all,

Please find our CFP below – would be great to see many submissions from you
😉

[ == Hacktivity 2015 Call For Papers == ]

Conference: October 9-10, 2015

CFP closing date: June 30, 2015

CFP notification to authors: July 31, 2015

Venue: Budapest, Hungary

Web: https://hacktivity.com

Email: cfp _!{at}!_ hacktivity.com

Twitter: @hacktivityconf

Hacktivity is the leading hacking conference in Hungary. Hacktivity brings
together…

TOR Virtual Network Tunneling Tool 0.2.6.8

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs).

Ubuntu Security Notice USN-2617-2

Ubuntu Security Notice 2617-2 – USN-2617-1 fixed a vulnerability in FUSE. This update provides the corresponding fix for the embedded FUSE copy in NTFS-3G. Tavis Ormandy discovered that FUSE incorrectly filtered environment variables. A local attacker could use this issue to gain administrative privileges. Various other issues were also addressed.

Debian Security Advisory 3268-1

Debian Linux Security Advisory 3268-1 – Tavis Ormandy discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing mount or umount with elevated privileges. A local user can take advantage of this flaw to overwrite arbitrary files and gain elevated privileges by accessing debugging features via the environment that would not normally be safe for unprivileged users.