Resolved Bugs
1247361 – CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service
1247754 – CVE-2015-5477 bind: TKEY query handling flaw leading to denial of service [fedora-all]<br
Update to 9.10.2-P3 to fix CVE-2015-5477
Monthly Archives: July 2015
Fedora 21 Security Update: bind-9.9.6-10.P1.fc21
Operation Potao Express: Analysis of a cyber-espionage toolkit
Operation Patao Express – Attackers spying on high-value targets in Ukraine, Russia and Belarus, and their TrueCrypt-encrypted data.
The post Operation Potao Express: Analysis of a cyber-espionage toolkit appeared first on We Live Security.
![]()
More than 50% of malware for Android is aimed at stealing from you. Keep an eye on your pocket!

With the barrage of news about Hacking Team, the massive cyber espionage by governments, and the US intelligence raids, it might seem that cybercriminals are taking a different route compared to your average criminal. However, don’t let this fool you as they are all after the same thing which, as the famous song goes, is “money, money, money”.
Wherever there’s money, there are sure to be malware creators. So after the boom in internet shopping people are beginning to reach for their pockets to make payments once again; not with their wallets though, but rather their cellphones.
According to a recent study carried out by IAB, 7 out of 10 Spaniards (more than 19 million internet users) regularly buy online. The percentage of those who make purchases from their cellphones or tablets is steadily increasing and currently accounts for 15% of all purchases. In other countries, such as the United States, the percentage of purchases from mobile devices is even greater.
These online purchases generally require the use of sensitive bank information as you are paying with a card or performing a transfer, but this doesn’t seem to bother consumers. According to a report by ING, nearly half of Europeans now use their smartphone or tablet to carry out bank transactions.

Slowly but surely tablets and smartphones are replacing the traditional computer for these types of tasks and, as a result, they have become a goldmine for cybercriminals. Financial malware, designed to gain access to your account, is thriving in the darkest corners of the internet.
More than half of all malware designed for Android has been created with stealing money in mind. This was confirmed by a recent study, which named Trojan and ransomware (which hijacks your terminal and requires a payment to unblock it) as the most popular tools deployed by cybercriminals.
It’s interesting to note that it is Android, and not iOS, which is the main target of attack. This is despite iOS taking a far larger profit share of the market. This is because, for the cybercriminals, it is all a matter of volume.
On a global level, Android is a far more popular system and accounts for 78% of the smartphone systems in operation, according to details from the IDC. Meanwhile, iOS only accounts for market share of 18.3%.
The more potential victims there are, the higher the yield for the cybercriminals, as we have seen with the infamous Sypeng and Faketoken cases, which wreaked havoc across the globe. So, if you have already been targeted by them you’re in a tricky situation, as prevention is better than the cure in this case.
An antivirus for Android and following some advice when completing transactions on your mobile device (such as avoiding public WiFi connections and avoiding applications that aren’t on Google Play) will save you a lot of hassle in the future.
The post More than 50% of malware for Android is aimed at stealing from you. Keep an eye on your pocket! appeared first on MediaCenter Panda Security.
CVE-2014-7912
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.
CVE-2014-7913
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.
Assessing The Computer Network Operation (CNO) Capabilities of the Islamic Republic of Iran – Report
Posted by Dancho Danchev on Jul 30
Hello,
01. Who’s who on Iran’s Cyber Warfare Scene – the most comprehensive
analysis of Iran’s cyber warface scene, ever performed
02. Where do they go to school? – in-depth analysis of Iran’s academic
incubators of the next generation of cyber warriors
03. Who’s buying them books? – in-depth geopolitically relevant
analysis of Iran’s cyber warfare doctrine
04. How do they own and compromise? – complimentary copies…
Fwd: CVE_for_Vulnerability_theholidaycalendar
Posted by Luciano Pedreira on Jul 30
———- Forwarded message ———-
From: Luciano Pedreira <lpedreira () gmail com>
Date: 2015-07-20 10:06 GMT-03:00
Subject: CVE_for_Vulnerability_theholidaycalendar
To: cve-assign () mitre org
Dear,
In a recent research conducted in the “The Holiday Calendar” plugin (
http://www.theholidaycalendar.com /
https://wordpress.org/plugins/the-holiday-calendar) I found vulnerability
related at Cross Site Scripting.
. The Holiday…
DSA-3320 openafs – security update
It was discovered that OpenAFS, the implementation of the distributed
filesystem AFS, contained several flaws that could result in
information leak, denial-of-service or kernel panic.
DSA-3321 xmltooling – security update
The InCommon Shibboleth Training team discovered that XMLTooling, a
C++ XML parsing library, did not properly handle an exception when
parsing well-formed but schema-invalid XML. This could allow remote
attackers to cause a denial of service (crash) via crafted XML data.