Slackware Security Advisory – New mozilla-thunderbird packages are available for Slackware 14.1 to fix security issues.
Monthly Archives: November 2014
Red Hat Security Advisory 2014-1862-01
Red Hat Security Advisory 2014-1862-01 – MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. This update fixes several vulnerabilities in the MariaDB database server.
Red Hat Security Advisory 2014-1860-01
Red Hat Security Advisory 2014-1860-01 – MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server.
Red Hat Security Advisory 2014-1861-01
Red Hat Security Advisory 2014-1861-01 – MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. This update fixes several vulnerabilities in the MariaDB database server.
Red Hat Security Advisory 2014-1859-01
Red Hat Security Advisory 2014-1859-01 – MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server.
If you have a flashlight app on your phone, be very careful!
The smartphone you keep in your pocket is amazing. It does everything. Despite all of the innovative things it does, one of the best features of smartphones is something as simple as it is old: the flashlight. Useful âin its own wayâ when taking pictures and even more so when you need to light up a dark corner.
There is no denying it. We have all used the flashlight on our phone to shake off the uneasiness (not to say fear) caused by the dark. However, and surprising as it may seem, perhaps we should not be so much afraid of the lack of light as of the app that we use on your phone to shed light.

Apps that control the flashlight on the phone â there are thousands in the app stores â are not as harmless as they may seem. It is true that you do not have to register or provide any data in order to use them but the flashlight on your phone knows a lot about you, which makes it an interesting target for cyber-crooks.
Flashlight 007, with a license for everything
As already mentioned, you do not tell your flashlight app anything but it is capable of shedding light on a good handful of conclusions about your movements. The worst thing is that if it does this, it is because you have allowed it to.
Before downloading any app you have to give it certain permissions. This gives many of the apps installed on smartphones permission to know your location using GPS data, to take pictures, record sounds and even read your text messages. This is particularly true of phones running Android as the operating system, because Windows and Apple restrict the capability of apps to spy on us (always with your permission, of course).
According to a report from SnoopWall, a company dedicated to smartphone security, flashlight apps are surprisingly quite demanding as regards permissions. A simple glance at the table compiled by SnoopWall could make your hair stand on end:

The apps included in the table are not selected at random. There is no need to rummage through tons of apps available on Google Play to find flashlights that want to find out everything about you. In fact, these ones in particular make up the top 10 flashlight apps for Android.
Of these, the least demanding asks for permission to read the phone status, take pictures and videos, view Internet connections and full network access. Other flashlight apps ask for permission for everything they can think of, GPS location included.
The problem, of course, is that we usually download and install apps in a hurry, accepting whatever the app asks for without thinking twice about it. By doing this you are practically handing the keys to your life â your digital life at leastâ Â to any stranger.

The key lies in advertising
The time has come to answer the big question. Why does a flashlight want so many permissions? Firstly, in general there is no need to worry: if these apps ask for so much it is because of advertising.
Another thing flashlight apps have in common is that they are free. Therefore, developers seek to monetize every download through advertising. Flashlight apps need an Internet connection and know your location and other data that allows advertising to be adapted to your habits.
Consequently, downloading and using these apps is not necessarily dangerous, but it is better to err on the side of caution. To prevent a cyber-crook from tricking you into installing one of these apps and stealing your data, it is better to use trusted apps.
Even though the most trusted apps ask for information and control of some of the tools on the phone, it is better to use those with the best statistics: the most downloaded and the highest rated are the most trustworthy. However, now you know that for these flashlights to provide light, first of all you will have to give them permission to shed some light on the inside of your phone (and they take everything of interest to them).
The post If you have a flashlight app on your phone, be very careful! appeared first on MediaCenter Panda Security.
Gentoo Linux Security Advisory 201411-05
Gentoo Linux Security Advisory 201411-5 – An absolute path traversal vulnerability could lead to arbitrary code execution. Versions less than 1.16 are affected.
HP Security Bulletin HPSBGN03192 1
HP Security Bulletin HPSBGN03192 1 – A potential security vulnerability has been identified with HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL. This is the SSLv3 vulnerability known as “Padding Oracle on Downgraded Legacy Encryption” also known as “Poodle”, which could be exploited remotely to allow disclosure of information. SSLv3 is enabled by default in the current HP iCAS client software. Revision 1 of this advisory.
Debian Security Advisory 3073-1
Debian Linux Security Advisory 3073-1 – Daniel Genkin, Itamar Pipman and Eran Tromer discovered that Elgamal encryption subkeys in applications using the libgcrypt11 library, for example GnuPG 2.x, could be leaked via a side-channel attack.
CVE-2014-3629 (qpid)
XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message.