Internet News Section
In the next Firefox release, some settings related to session recovery after exiting the browser will be changed. Unlike previous versions, information about not only active tabs but also recently closed tabs will be saved between sessions, allowing users to restore accidentally closed tabs after restarting and view their list in Firefox View. More details […]
ARM has disclosed information about three vulnerabilities in the drivers for its GPUs used in Android, ChromeOS, and Linux distributions. The vulnerabilities allow an unprivileged local user to execute their code with kernel privileges. The October security report for the Android platform mentions that one of the vulnerabilities (CVE-2023-4211) has already been exploited by attackers in working exploits before a fix is available […]
Qualys has identified a dangerous vulnerability (CVE-2023-4911) in the ld.so linker, included with the system C library Glibc (GNU libc). The vulnerability allows a local user to elevate their privileges in the system by specifying specially crafted data in the GLIBC_TUNABLES environment variable before launching an executable file with the suid root flag, such as /usr/bin/su. Successful exploitation of the vulnerability has been demonstrated in Fedora 37 and 38, […]
The developers of the Linux Mint distribution have announced the release of a new ISO image called 'Edge', which is based on the July release of Linux Mint 21.2 with a Cinnamon desktop and features the Linux kernel 6.2 instead of 5.15. Additionally, the proposed ISO image restores support for UEFI SecureBoot mode. This build is aimed at users of new hardware experiencing installation and booting issues […]
The portable version of the OpenBGPD routing package 8.2 has been released, developed by the OpenBSD project and adapted for use in FreeBSD and Linux (support is claimed for Alpine, Debian, Fedora, RHEL/CentOS, Ubuntu). To ensure portability, parts of the code from the OpenNTPD, OpenSSH, and LibreSSL projects have been used. The project supports most of the BGP 4 specifications and complies with the requirements of RFC8212, but it does not attempt to cover everything […]
Canonical has announced a temporary suspension of the automatic publishing package verification system in the Snap Store due to the appearance of packages with malicious code intended to steal cryptocurrency from users. It is unclear whether the incident is limited to the publication of malicious packages by third-party authors or whether there are security issues directly with the repository, as the situation in the official announcement is characterized by […]
The release of SBCL 2.3.9 (Steel Bank Common Lisp), a free implementation of the Common Lisp programming language, has been published. The project's code is written in Common Lisp and C, and is distributed under the BSD license. In this new release: Stack allocation via DYNAMIC-EXTENT now applies not only to the initial binding but also to all values that a variable can take (for example, via SETQ). This […]
After four years of development, the release of the auto-cpufreq 2.0 utility has been announced, designed for automatic optimization of CPU speed and power consumption in the system. The utility monitors the laptop's battery state, CPU load, CPU temperatures, and activity in the system, and dynamically activates power-saving or high-performance modes based on the situation and selected options. For example, auto-cpufreq can be used to automatically […]
Several recently identified vulnerabilities: CVE-2023-39191 — a vulnerability in the eBPF subsystem that allows a local user to escalate their privileges and execute code at the Linux kernel level. This vulnerability is caused by improper verification of eBPF programs submitted by a user for execution. To exploit this, the user must be able to load their BPF program (if the kernel.unprivileged_bpf_disabled parameter is set to 0, for example, as in Ubuntu 20.04). […]
A year and a half after the last release, an alternative build of the Linux Mint distribution — Linux Mint Debian Edition 6, based on the Debian package base (the classic Linux Mint is based on the Ubuntu package base) — has been released. The distribution is available as installation iso images with the Cinnamon 5.8 desktop environment. LMDE is aimed at technically savvy users and provides newer versions […]
A group of researchers from several universities in the USA has developed a new side-channel attack technique that allows the recreation of visual information processed by the GPU. Using the proposed method, known as GPU.zip, an attacker can determine the information displayed on the screen. Among other things, the attack can be conducted via a web browser; for example, it has been demonstrated how a malicious webpage opened in Chrome can obtain information about […]
The Zero Day Initiative (ZDI) has revealed details about unpatched (0-day) vulnerabilities (CVE-2023-42115, CVE-2023-42116, CVE-2023-42117) in the Exim mail server, allowing for remote code execution on a server with the privileges of the process accepting connections on network port 25. No authentication is required for the attack. The first vulnerability (CVE-2023-42115) is caused by an error in the SMTP service and is related to the lack of proper data checks, […]