jschauma, 4 months ago to random

Qualys just published two vulnerabilities in #glibc

• an out-of-bounds read/write in qsort dating back to glibc 1.04 (1992): https://www.openwall.com/lists/oss-security/2024/01/30/7
• CVE-2023-6246: Heap-based buffer overflow in syslog() in glibc >=2.37 (August 2022): https://www.openwall.com/lists/oss-security/2024/01/30/6

The latter allows for a local user privilege escalation to root.

As usual, the Qualys vulnerability write-ups are excellent and provide a detailed walk-through of the code.

harrysintonen, 4 months ago to random

CVE-2023-6246 - #glibc syslog() heap-based buffer overflow #vulnerability - https://www.openwall.com/lists/oss-security/2024/01/30/6 - Impact: local privilege escalation to root #CVE

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

civodul, 4 months ago to guix

“Building packages targeting psABIs”
https://guix.gnu.org/en/blog/2024/building-packages-targeting-psabis/

@efraim shares clever #Guix tricks on how to ship optimized code using #glibc’s /lib/hwlibc-hwcaps search.

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 4 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 5 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 5 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 5 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 5 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 5 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

fsf, 6 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

0xor0ne, 6 months ago to infosec

Excellent blog post explaining how the heap works in glibc (v2.31)

https://jackfromeast.site/2023-01/understand-the-heap-a-beautiful-mess.html

#infosec #glibc #heap

image/jpeg
image/jpeg

0x58, 6 months ago to Cybersecurity

📨 Latest issue of my curated #cybersecurity and #infosec list of resources for week #45/2023 is out! It includes the following and much more:

➝ 🔓 ✈️ #Boeing breach: LockBit leaks 50 GB of data
➝ 🇨🇳 World’s largest commercial bank #ICBC confirms #ransomware attack
➝ 🔓 ☁️ Sumo Logic alerts customers about #securityincident; advises rotate Sumo Logic API access keys
➝ 🔓 🇮🇪 Electric Ireland admits data breach that could see customer financial data compromised
➝ 🔓 🇨🇦 #TransForm says ransomware data breach affects 267,000 patients
➝ 🔓 🇸🇬 #Singapore Marina Bay Sands reward members data breached, over 650k people exposed
➝ 🇮🇱 🇵🇸 🇮🇷 Cyber ops linked to #Israel-#Hamas conflict largely improvised, researchers say
➝ 🧨 🤖 #OpenAI confirms #DDoS attacks behind ongoing #ChatGPT outages
➝ 🛍️ 💸 Fake Ledger Live app in #Microsoft Store steals $768,000 in #crypto
➝ 🔓 🐰 ‘Looney Tunables’ #Glibc Vulnerability Exploited in #Cloud Attacks
➝ 🇺🇸 🇷🇺 US Sanctions Russian National for Helping Ransomware Groups Launder Money
➝ 🇮🇷 🇮🇱 Iranian Hackers Launch Destructive Cyber Attacks on Israeli #Tech and #Education Sectors
➝ 🇫🇷 🇬🇧 #France, #UK Seek Greater Regulation of Commercial #Spyware
➝ 🇪🇺 🤐 #Europe is trading security for digital #sovereignty
➝ 🇷🇺 🇺🇦 Russian Hackers Used #OT Attack to Disrupt Power in #Ukraine Amid Mass Missile Strikes
➝ 🦠 🚪 Highly invasive #backdoor snuck into #opensource packages targets developers
➝ 🦠 🇰🇵 N. Korea's #BlueNoroff Blamed for Hacking #macOS Machines with ObjCShellz #Malware
➝ 🫣 #Signal tests usernames that keep your phone number private
➝ 🔐 Microsoft Authenticator now blocks suspicious #MFA alerts by default
➝ ☁️ 💰 Researchers Uncover Undetectable #CryptoMining Technique on #Azure Automation
➝ 👥 💰 Data Brokers Expose Sensitive US Military Member Info to Foreign Threat Actors: Study
➝ 🩹 Microsoft Says Exchange ‘Zero Days’ Disclosed by #ZDI Already Patched or Not Urgent
➝ 🐛 Veeam warns of critical bugs in #Veeam ONE monitoring platform

📚 This week's recommended reading is: "How the F*ck Did This Happen?: A guide for executives who need to understand Cyber Security in plain, actionable language" by Dr Darryl Carlton

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end ⬇️

https://infosec-mashup.santolaria.net/p/infosec-mashup-week-452023

fsf, 7 months ago to emacs

Assigning your copyright to the FSF helps defend the GPL and keep software free. Thanks to Gene Goykhman, Sergey Alexandrovich Bugaev, Wang Diancheng, Warren Thomas Everett Wilkinson, and Xinyuan Zhang for assigning their copyright to the FSF! #GNU #Emacs #glibc #GDB #GNUstep #GNUHurd #GNUMach #GCC Learn more at https://u.fsf.org/3ht #CopyrightAssignments

nixCraft, 7 months ago to linux

I'd like to interject for a moment .. but I can't ... #linux #gnu

kkarhan, 7 months ago to random German

Whilst I work on #OS1337's #MinimumViableProduct aka. #CORE / #FloppyEdition, I'm thinking about the other, more featureful versions.
https://github.com/OS-1337/OS1337/tree/main/docu/ideas

Besides a #BootFloppy to launch a #CDROM version there are a lot of tools I'd love to support:

1. a Package Manager so people can just install & update shit easily:
   https://github.com/OS-1337/spm

2. Good default Configs for a System like NTP & DNS Servers unless those are being offered per DHCP.
   https://github.com/OS-1337/conf.d