USN-3216-2: Firefox regression

Ubuntu Security Notice USN-3216-2

30th March, 2017

firefox regression

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 16.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

USN-3216-1 introduced a regression in Firefox.

Software description

  • firefox
    – Mozilla Open Source web browser

Details

USN-3216-1 fixed vulnerabilities in Firefox. The update resulted in a
startup crash when Firefox is used with XRDP. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417,
CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422,
CVE-2017-5426, CVE-2017-5427)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:
firefox

52.0.2+build1-0ubuntu0.16.10.1
Ubuntu 16.04 LTS:
firefox

52.0.2+build1-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
firefox

52.0.2+build1-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
firefox

52.0.2+build1-0ubuntu0.12.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

LP: 1671079

Panda Security’s GDPR Preparation Guide Helps Ease the Transition to the New Regulation

There’s a new challenge that lies ahead for businesses that have operations within the European Union. The new General Data Protection Regulation came into effect on 25 May, 2016, and will begin to be enforced 25 May, 2018.

With the focus on protecting the fundamental rights and freedoms of natural persons and their right to the protection of personal data, the regulation establishes obligations and advantages both for private entities and public administrations.

Panda Security’s “Preparation Guide to the New European General Data Protection Regulation” introduces the new legislation to businesses before its application in 2018. Disregarding the application of the GDPR could lead to costly administration fines of up to 20,000,000 euros.

Panda’s objective is to address the need to adapt data security practices and thereby give its clients a competitive advantage.

How will the GDPR affect businesses?

One of the main points of the white paper is that taking action only when an infringement has already occurred is insufficient as a strategy, since such a failure can cause irreversible damage to interested parties and can be very difficult to compensate.

Here are some sanctions and other potential problems stemming from non-compliance with the GDPR:

  • Direct or indirect economic repercussions. These could result from security incidents coming from outside the company or from a company’s own employees and collaborators.
  • PR damages. Damages to your reputation could result from security incidents not properly being reported to the public.
  • The loss of current or potential clients may occur when the company is unable to demonstrate that it is in compliance with the regulation.
  • The risk of data-processing limits or bans imposed by data protection audits, which could affect the normal functioning of a company.
  • The possible suspension of your service for your clients, which could induce them to leave your service or even take legal action.
  • Reparations that interested parties will have the right to claim in case of infringement.
  • Costly administration fines that could reach up to 20,000,000€ or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.

Panda Security, a partner in compliance with the new law

For organizations dealing with data, prevention is the core element of the regulation. We underscore the importance of working with vision and anticipation as a competitive advantage in business strategy.

Businesses that have put their trust in Adaptive Defense are already well on their way to complying with the GDPR. It offers:

  • Prevention: Adaptive Defense features an internal audit system to verify the security status of the IT infrastructure at any given time, even before the solution is deployed. In the implementation of the action plan for compliance with the GDPR, it proves to be an invaluable tool.
  • Protection of personal data processed on a business’s systems, stopping, for example, any untrusted process from running.
  • Risk reduction, key activity indicators, and endpoint status, which helps to establish security protocols.
  • Tools to satisfy the requirement to notify authorities of security incidents within the first 72 hours after a breach·
  • Control mechanisms and data management for the DPO, who will be notified in real time not only of security incidents, but also whether or not these incidents involve compromised personal data files.

 

The post Panda Security’s GDPR Preparation Guide Helps Ease the Transition to the New Regulation appeared first on Panda Security Mediacenter.

Splunk Enterprise Information Theft – CVE-2017-5607

Posted by hyp3rlinx on Mar 30

[+] Credits: John Page AKA hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/SPLUNK-ENTERPRISE-INFORMATION-THEFT.txt
[+] ISR: ApparitionSec

Vendor:
===============
www.splunk.com

Product:
==================
Splunk Enterprise

Splunk provides the leading platform for Operational Intelligence.
Customers use Splunk to search, monitor, analyze
and visualize machine data. Splunk Enterprise,…

CVE-2017-6973

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted ‘action’ parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

CVE-2017-7241

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted ‘type’ parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the “Post-installation and upgrade tasks” of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.

CVE-2017-7309

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted ‘config_option’ parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.