LWN.net's Journal
 
 [Most Recent Entries] [Calendar View]

Monday, January 11th, 2016

    Time Event
    6:42p
    Security updates for Monday

    Arch Linux has updated dhcpcd (denial of service), gajim (man-in-the-middle), wireshark-cli (multiple vulnerabilities), wireshark-gtk (multiple vulnerabilities), wireshark-qt (multiple vulnerabilities), and wordpress (cross-site scripting).

    Debian has updated gnutls26 (signature forgery), openssl (signature forgery), perl (returns untainted strings), prosody (two vulnerabilities), sudo (privilege escalation), and xscreensaver (denial of service).

    Debian-LTS has updated icu (information leak) and sudo (privilege escalation).

    Fedora has updated kea (F23: denial of service), mod_nss (F23: enables insecure ciphersuites), and rsync (F23: unsafe destination path).

    Mageia has updated armagetron (two vulnerabilities), kernel (multiple vulnerabilities), phpmyadmin (installation path disclosure), pitivi (code execution), and rtmpdump (code execution).

    openSUSE has updated phpMyAdmin (Leap42.1, 13.2, 13.1: installation path disclosure), pitivi (Leap42.1, 13.2: code execution), and rubygem-mail, (Leap42.1, 13.2: SMTP injection).

    Oracle has updated kernel 3.8.13 (OL7; OL6: denial of service), kernel 2.6.39 (OL6; OL5: multiple vulnerabilities), kernel 2.6.32 (OL6; OL5: multiple vulnerabilities).

    Red Hat has updated openstack-nova (RHELOSP5,6,7 for RHEL7; RHELOSP5 for RHEL6: information leak).

    Ubuntu has updated firefox (signature forgery).

    8:34p
    US military still SHAckled to outdated DoD PKI infrastructure (Netcraft)
    Netcraft reports
    that the US Department of Defense (DoD) is still issuing SHA-1 signed
    certificates, and using them to secure connections to .mil websites.
    "The DoD is America's largest government agency, and is tasked with protecting the security of its country, which makes its continued reliance on SHA-1 particularly remarkable. Besides the well known security implications, this reliance could already prove problematic amongst the DoD's millions of employees. For instance, Mozilla Firefox 43 began rejecting all new SHA-1 certificates issued since 1 January 2016. When it encountered one of these certificates, the browser displayed an Untrusted Connection error, although this could be overridden. If DoD employees become accustomed to ignoring such errors, it could become much easier to carry out man-in-the-middle attacks against them."

    << Previous Day 2016/01/11
    [Calendar]     		Next Day >>

LWN.net   About LJ.Rossia.org