From security em unicamp.br Tue Sep 6 09:54:41 2022 From: security em unicamp.br (CSIRT Unicamp) Date: Tue, 6 Sep 2022 09:54:41 -0300 Subject: [SECURITY-L] Zero-Day Chrome Message-ID: Prezados. Devido a um Zero-Day descoberto é orientado a imediata atualização dos browsers Chrome. Maiores informações nos links abaixo. https://www.zdnet.com/article/malicious-google-chrome-extensions-affect-1-4-million-users/?ftag=TRE-03-10aaa6b&bhid=%7B%24external_id%7D&mid=%7B%24MESSAGE_ID%7D&cid=%7B%24contact_id%7D https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html Atenciosamente. === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Thu Sep 22 08:47:25 2022 From: security em unicamp.br (CSIRT Unicamp) Date: Thu, 22 Sep 2022 08:47:25 -0300 Subject: [SECURITY-L] [oss-security] ISC has disclosed six vulnerabilities in BIND (CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080, CVE-2022-38177, CVE-2022-38178) Message-ID: On 21 September 2022 we (Internet Systems Consortium) disclosed six vulnerabilities affecting our BIND 9 software: - CVE-2022-2795: Processing large delegations may severely degrade resolver performance https://kb.isc.org/docs/cve-2022-2795 - CVE-2022-2881: Buffer overread in statistics channel code https://kb.isc.org/docs/cve-2022-2881 - CVE-2022-2906: Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only) https://kb.isc.org/docs/cve-2022-2906 - CVE-2022-3080: BIND 9 resolvers configured to answer from stale cache with zero stale-answer-client-timeout may terminate unexpectedly https://kb.isc.org/docs/cve-2022-3080 - CVE-2022-38177: Memory leak in ECDSA DNSSEC verification code https://kb.isc.org/docs/cve-2022-38177 - CVE-2022-38178: Memory leaks in EdDSA DNSSEC verification code https://kb.isc.org/docs/cve-2022-38178 New versions of BIND are available from https://www.isc.org/downloads Operators and package maintainers who prefer to apply patches selectively can find individual vulnerability-specific patches in the "patches" subdirectory of the release directories for our stable release branches (9.16 and 9.18): - https://downloads.isc.org/isc/bind9/9.16.33/patches/ - https://downloads.isc.org/isc/bind9/9.18.7/patches/ With the public announcement of these vulnerabilities, the embargo period is ended and any updated software packages that have been prepared may be released. -- Best regards, Micha? K?pie? === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: From security em unicamp.br Wed Sep 28 14:32:05 2022 From: security em unicamp.br (CSIRT Unicamp) Date: Wed, 28 Sep 2022 14:32:05 -0300 Subject: [SECURITY-L] [Security-news] Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2022-016 In-Reply-To: References: Message-ID: View online: https://www.drupal.org/sa-core-2022-016 Project: Drupal core [1] Date: 2022-September-28 Security risk: *Critical* 18?25 AC:Basic/A:Admin/CI:All/II:All/E:Proof/TD:All [2] Vulnerability: Multiple vulnerabilities Affected versions: >= 8.0.0 <9.3.22 || >= 9.4.0 <9.4.7 Description: Drupal uses the Twig [3] third-party library for content templating and sanitization. Twig has released a security update [4] that affects Drupal. Twig has rated the vulnerability as high severity. Drupal core's code extending Twig has also been updated to mitigate a related vulnerability. Multiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials. The vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates. Solution: Install the latest version: * If you are using Drupal 9.4, update to Drupal 9.4.7 [5]. * If you are using Drupal 9.3, update to Drupal 9.3.22 [6]. All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Drupal 7 core does not include Twig and therefore is not affected. Reported By: * Fabien Potencier [8] * Nicolas Grekas [9] * James Williams [10] Fixed By: * xjm [11] of the Drupal Security Team * Alex Pott [12] of the Drupal Security Team * Sascha Grossenbacher [13] * Lee Rowlands [14] of the Drupal Security Team * Lauri Eskola [15], provisional member of the Drupal Security Team * Nathaniel Catchpole [16] of the Drupal Security Team * Dave Long [17], provisional member of the Drupal Security Team * cilefen [18] of the Drupal Security Team * James Williams [19] * Benji Fisher [20], provisional member of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://twig.symfony.com/ [4] https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader [5] https://www.drupal.org/project/drupal/releases/9.4.7 [6] https://www.drupal.org/project/drupal/releases/9.3.22 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/1467782 [9] https://www.drupal.org/user/3407972 [10] https://www.drupal.org/user/592268 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/157725 [13] https://www.drupal.org/user/214652 [14] https://www.drupal.org/user/395439 [15] https://www.drupal.org/user/1078742 [16] https://www.drupal.org/user/35733 [17] https://www.drupal.org/user/246492 [18] https://www.drupal.org/user/1850070 [19] https://www.drupal.org/user/592268 [20] https://www.drupal.org/user/683300 _______________________________________________ Security-news mailing list Security-news em drupal.org === Computer Security Incident Response Team - CSIRT Universidade Estadual de Campinas - Unicamp Centro de Computacao - CCUEC GnuPG Public Key: http://www.security.unicamp.br/security.asc [^] Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830 -------------- Próxima Parte ---------- Um anexo em HTML foi limpo... URL: