[월:] 2016년 04월

No Image

Microsoft Bounty Programs Expansion – Nano Server Technical Preview Bounty

2016-04-30 KENNETH 0

Microsoft Bounty Programs Expansion – Nano Server Technical Preview Bounty Microsoft is pleased to announce another expansion of the Microsoft Bounty Programs. Today we begin a bounty for the Nano Server installation option of Windows Server 2016 Technical Preview 5. Please visit https://aka.ms/BugBounty to find more details. Nano Server is a remotely administered, headless installation option of the server operating system. In this first release, the Nano Server deployment is focused on two scenarios: As the host for compute and/or storage clusters As a lightweight OS in a VM or container for “born in the cloud” applications. In summary: All binaries included in the Nano Server configuration of Windows Server 2016 Technical Preview 5 and any subsequent Betas, Technical Previews or Release Candidates during the bounty period Hyper-V escapes and Mitigation Bypass vulnerabilities will be evaluated against the Mitigation Bypass [ more… ]

No Image

Changes to Security Update Links

2016-04-30 KENNETH 0

Changes to Security Update Links Updates have historically been published on both both the Microsoft Download Center and the Microsoft Update Catalog and Security Bulletins linked directly to update packages on the Microsoft Download Center. Starting May 10, some updates will no longer be available from the Microsoft Download Center. Security bulletins will continue to link directly to the updates, but will now point to the packages on the Microsoft Update Catalog for updates not available on the Microsoft Download Center. Customers that use tools linking to the Microsoft Download Center should follow the links provided in the Security Bulletins or search directly on the Microsoft Update Catalog. For tips on searching the Microsoft Update Catalogue visit the frequently asked questions page. Source: Changes to Security Update Links

No Image

USN-2956-1: ubuntu-core-launcher vulnerability

2016-04-30 KENNETH 0

USN-2956-1: ubuntu-core-launcher vulnerability Ubuntu Security Notice USN-2956-1 29th April, 2016 ubuntu-core-launcher vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary ubuntu-core-launcher did not properly isolate snaps from one another. Software description ubuntu-core-launcher – Snap application launcher Details Zygmunt Krynicki discovered that ubuntu-core-launcher did not properlysanitize its input and contained a logic error when determining themountpoint of bind mounts when using snaps on traditional Ubuntu systems(eg, desktop and server). If a user were tricked into installing amalicious snap with a crafted snap name, an attacker could perform adelayed attack to steal data or execute code within the security context ofanother snap. This issue did not affect Ubuntu Core systems. Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 16.04 LTS: ubuntu-core-launcher 1.0.27.1 To update your system, [ more… ]

No Image

RHSA-2016:0701-1: Critical: java-1.7.1-ibm security update

2016-04-29 KENNETH 0

RHSA-2016:0701-1: Critical: java-1.7.1-ibm security update Red Hat Enterprise Linux: An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449 Source: RHSA-2016:0701-1: Critical: java-1.7.1-ibm security update