This update ships updated CPU microcode for some types of Intel CPUs andprovides SSBD support (needed to address Spectre v4) and fixes forSpectre v3a.
More info:
https://www.debian.org/security/2018/dsa-4273
Kristi Nikolla discovered an information leak in Keystone, the OpenStackidentity service, if running in a federated setup.
More info:
https://www.debian.org/security/2018/dsa-4275
CVE-2018-5391 (FragmentSmack) Juha-Matti Tilli discovered a flaw in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker can take advantage of this flaw to trigger time and calculation expensive fragment reassembly algorithms by sending specially crafted packets, leading to remote denial of service.
More info:
https://www.debian.org/security/2018/dsa-4272
Red Hat Enterprise Linux: An update for kernel is now available for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having a security impact ofImportant. A Common Vulnerability Scoring System (CVSS) base score, which givesa detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.[Updated 16th August 2018]The original errata text was missing reference to CVE-2018-5390 fix. We haveupdated the errata text to correct
More info:
http://rhn.redhat.com/errata/RHSA-2018-2390.html
BIG-IP APM client for Linux and macOS vulnerabilitiy CVE-2018-5546. Security Advisory. Security Advisory Description. The ...
More info:
https://support.f5.com/csp/article/K54431371
BIG-IP APM client for Windows vulnerability CVE-2018-5547. Security Advisory. Security Advisory Description. Windows ...
More info:
https://support.f5.com/csp/article/K10015187
August 16, 2018 2:45 PM PDT CVE Identifiers: CVE-2018-3620, CVE-2018-3646 Intel has published a security advisory (INTEL-SA-00161) regarding a new side-channel analysis method concerning their processors called "L1 Terminal Fault" (L1TF). AWS has designed and implemented its infrastructure with protections against these types of attacks, and has also deployed additional protections for L1TF. All EC2 host infrastructure has been updated with these new protections, and no customer
More info:
https://aws.amazon.com/security/security-bulletins/AWS-2018-019/
- El ataque aprovecha la forma en la que las apps utilizan el sistema de almacenamiento externo para dar como resultado una inyección de código.
Los investigadores de seguridad de Check Point Software Technologies han descubierto un nuevo vector de ataque contra el sistema operativo Android que podría permitir a los atacantes infectar silenciosamente sus teléfonos inteligentes con aplicaciones maliciosas o lanzar ataques de denegación de servicio.
Conceptos base:
- Es bien conocido que las aplicaciones en el sistema operativo Android pueden almacenar sus recursos en el dispositivo en dos ubicaciones: almacenamiento interno y externo.
- Google, insta a los desarrolladores a usar el almacenamiento interno, que es un espacio aislado asignado a cada aplicación protegida usando el 'sandbox' integrado de Android, para almacenar sus archivos o datos confidenciales.
- Sin embargo, los investigadores encontraron que muchas aplicaciones usaban almacenamiento externo sin protección al que cualquier aplicación instalada en el mismo dispositivo puede acceder.
Más información
Today, VMware has released the following new and updated security advisories: VMSA-2018-0022 – VMware Workstation and Fusion updates address an out-of-bounds write issue VMSA-2018-0019.1 – Horizon 6, 7, Horizon Agent, and Horizon Client for Windows updates address an out-of-bounds read vulnerability VMSA-2018-0022 documents the remediation of a critical severity out-of-bounds read vulnerability (CVE-2018-6973) in VMware […]The post New VMware Security Advisory VMSA-2018-0022
More info:
https://blogs.vmware.com/security/2018/08/new-vmware-security-advisory-vmsa-2018-0022-and-updated-security-advisory-vmsa-2018-0019-1.html
Red Hat Enterprise Linux: An update for flash-plugin is now available for Red Hat Enterprise Linux 6Supplementary.Red Hat Product Security has rated this update as having a security impact ofImportant. A Common Vulnerability Scoring System (CVSS) base score, which givesa detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. CVE-2018-12824, CVE-2018-12825, CVE-2018-12826, CVE-2018-12827, CVE-2018-12828
More info:
http://rhn.redhat.com/errata/RHSA-2018-2435.html
