Posted by Apple Product Security on Dec 09
APPLE-SA-2015-12-08-2 tvOS 9.1
tvOS 9.1 is now available and addresses the following:
AppleMobileFileIntegrity
Available for: Apple TV (4th generation)
Impact: A malicious application may be able to execute arbitrary
code with system privileges
Description: An access control issue was addressed by preventing
modification of access control structures.
CVE-ID
CVE-2015-7055 : Apple
AppSandbox
Available for: Apple TV (4th generation)
Impact:…
Posted by Rio Sherri on Dec 09
Posted by Vogt, Thomas on Dec 09
secunet Security Networks AG Security Advisory
Advisory: SECURE DATA SPACE API Multiple Non-Persistent Cross-Site Scripting Vulnerabilities
1. DETAILS
———-
Product: SECURE DATA SPACE
Vendor URL: www.ssp-europe.eu
Type: Cross-site Scripting[CWE-79]
Date found: 2015-09-30
Date published: 2015-12-09
CVSSv2 Score: 4,3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVE: CVE-2015-7706
2. AFFECTED VERSIONS
——————–
All product versions (Online,…
Posted by Karn Ganeshen on Dec 09
# Title: [LG Nortel ADSL modems – Multiple vulnerabilities]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [NA]
# Version Reported: [Board ID: DV2020]+Product Version: S1.064B2.3H0-0 +
Software Version: 3.04L.02V.sip._LE9500.dspApp3341A2pB022f.d19e]
*Timelines*
April, 2015: Vulnerabilities found
April 2015: Reported to Optus & CERT
April – October 2015: CERT (US/AUS) attempts to identify vendor / device
ownership. None found.
Dec 03,…
Posted by Stefan Kanthak on Dec 09
Hi @ll,
the executable installers [°] of the videolan client (VLC, see
<http://www.videolan.org/>) are vulnerable:
1. They load and execute a rogue/bogus/malicious ShFolder.dll [‘][²]
(and other DLLs like SetupAPI.dll or UXTheme.dll too) eventually
found in the directory they are started from (the “application
directory”).
For software downloaded with a web browser this is typically the…
Posted by Stefan Kanthak on Dec 09
Hi @ll,
executable (un)installers [°] created with Nullsoft Scriptable Install
System (NSIS, see <http://nsis.sourceforge.net/>; for some of its
victims see <http://nsis.sourceforge.net/users>) are vulnerable:
1. They load and execute a rogue/bogus/malicious ShFolder.dll [‘][²]
(and other DLLs like SetupAPI.dll or UXTheme.dll too) eventually
found in the directory they are started from (the “application…
Posted by Stefan Kanthak on Dec 09
Hi @ll,
executable installers [°] created with JRSoft InnoSetup
(see <http://jrsoftware.org/isinfo.php>; this includes of course
InnoSetup itself too) are vulnerable:
1. They load and execute a rogue/bogus/malicious UXTheme.dll [‘]
eventually found in the directory they are started from (the
“application directory”).
For software downloaded with a web browser this is typically the
“Downloads”…
Posted by Stefan Kanthak on Dec 09
Hi @ll,
the executable installers [°] of 7-Zip (see <http://www.7-zip.org/>)
and ALL self-extracting archives created with 7-Zip are vulnerable:
1. They load and execute a rogue/bogus/malicious UXTheme.dll [‘]
eventually found in the directory they are started from (the
“application directory”).
For software downloaded with a web browser this is typically the
“Downloads” directory: see
<…
Posted by Stefan Kanthak on Dec 09
Hi @ll,
the executable installers [°] of Google Chrome are vulnerable:
1. ChromeStandaloneSetup.exe and ChromeSetup.exe load and execute
a rogue/bogus/malicious CryptBase.dll (under Windows NT6.x)
from their “application directory” [‘].
For software downloaded with a web browser this is typically the
“Downloads” directory: see
<…
An unusual DDoS amplification attack was carried out 10 days ago against many of the Internet’s 13 root name servers, the authoritative servers used to resolve IP addresses.