Internet News Section
An update for the Solaris 11.4 operating system, SRU 24 (Support Repository Update), has been released, featuring a series of corrections and improvements for the Solaris 11.4 branch. To install the proposed fixes in the update, simply execute the command 'pkg update'. The new release includes: An updated Oracle Explorer to version 20.2, a toolkit for building detailed configuration and system status profiles; Added support for storage […]
Corrective releases of the Icinga Web 2.6.4, 2.7.4, and v2.8.2 packages, which provide a web interface for the Icinga monitoring system, have been published. The proposed updates address a critical vulnerability (CVE-2020-24368), allowing an unauthenticated attacker to access files on the server with the privileges of the Icinga Web process (typically the user under which the HTTP server or FPM runs). A successful attack requires one of the third-party modules supplied […]
Researchers from Ruhr University Bochum (Germany) analyzed (PDF) the behavior of email clients when processing 'mailto:' links with extended parameters. Five out of the twenty email clients reviewed were found to be vulnerable to an attack that manipulates resource substitution using the 'attach' parameter. An additional six email clients were susceptible to attacks through PGP and S/MIME key replacement, while three clients were vulnerable to […]
A new version of the fully functional file manager nnn has been released, optimized for efficient workflow (searching, filtering, sorting, renaming, instant handling of thousands of files). The program uses minimal resources (binary 100KB, 3.5MB in RAM), is compatible with Pi, Termux (Android), Linux, macOS, BSD, Haiku, Cygwin, WSL, and various graphical and console environments. The program operates with 8 color […]
The release of Kali Linux 2020.3 has occurred, designed for testing systems for vulnerabilities, conducting audits, analyzing residual information, and identifying the consequences of attacks by malicious actors. All original developments created within the distribution are distributed under the GPL license and are available through a public Git repository. Several ISO image options have been prepared for download, sized at 430 MB, 2.9 GB, and 3.7 GB. The builds […]
The current maintainers of the Qt framework packages in Debian have decided not to provide support for the next major branch Qt 6, the release of which is scheduled for December. Meanwhile, support for the previous branch Qt 5 will continue unchanged. The delivery of Qt 6 to Debian will be ensured if new maintainers are found who are ready to provide package support at a suitable level […]
Mozilla has announced an expansion of its initiative to pay monetary rewards for identifying security issues in Firefox. In addition to vulnerabilities, the Bug Bounty program will now cover methods to circumvent existing browser mechanisms that prevent exploits. Such mechanisms include an HTML fragment cleansing system before use in a privileged context and memory separation for DOM nodes […]
The main development team of the Rust programming language (Rust Core Team) and Mozilla have announced plans to create an independent non-profit organization, the Rust Foundation, by the end of the year. This organization will be entrusted with the intellectual property related to the Rust project, including trademarks and domain names associated with Rust, Cargo, and crates.io. The organization will also be responsible for organizing project funding. Recall that […]
The release of Parrot 4.10, based on the Debian Testing package base and including a set of tools for system security testing, forensic analysis, and reverse engineering, is now available. Several ISO images are offered for download with the MATE environment (full 4.2 GB and minimal 1.8 GB), with the KDE desktop (2 GB), and with the Xfce desktop (1.7 GB). The Parrot distribution […]
Google announced the introduction of protection against insecure submission of web forms in the upcoming release of Chrome 86. This protection targets forms displayed on pages loaded via HTTPS but submitting data without encryption over HTTP, which creates risks of data interception and modification during MITM attacks. Three changes have been implemented for such mixed web forms: Autocompletion of any mixed input forms has been disabled, […]
The essence of what happened In May 2020, a group of outgoing nodes was discovered that interfered with outbound connections. Specifically, they left almost all connections untouched but intercepted connections to a small number of cryptocurrency exchanges. If users visited the HTTP version of the site (i.e., unencrypted and unauthenticated), the malicious nodes prevented redirecting to the HTTPS version (i.e., encrypted and authenticated). If the user did not notice the substitution […]
The developers of Notepad++, the free (GPLv3) code editor for the Windows platform, have announced the project’s blockage in China. Despite only supporting the Windows platform, Notepad++ is very popular among Ubuntu users and ranks 5th among the most popular snap packages for developers (runs via Wine). It is speculated that the reason for Notepad++’s blockage was the project’s involvement in actions against […]