SECURITY

No Image

USN-3336-1: NSS vulnerability

2017-06-22 KENNETH 0

USN-3336-1: NSS vulnerability Ubuntu Security Notice USN-3336-1 21st June, 2017 nss vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary NSS could be made to crash if it received specially crafted network traffic. Software description nss – Network Security Service library Details It was discovered that NSS incorrectly handled certain empty SSLv2messages. A remote attacker could possibly use this issue to cause NSS tocrash, resulting in a denial of service. Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.04: libnss3 2:3.28.4-0ubuntu0.17.04.2 Ubuntu 16.10: libnss3 2:3.28.4-0ubuntu0.16.10.2 Ubuntu 16.04 LTS: libnss3 2:3.28.4-0ubuntu0.16.04.2 Ubuntu 14.04 LTS: libnss3 2:3.28.4-0ubuntu0.14.04.2 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart any applicationsthat use NSS, [ more… ]

No Image

Extending the Microsoft Edge Bounty Program

2017-06-22 KENNETH 0

Extending the Microsoft Edge Bounty Program Over the past ten months we have paid out over $200,000 USD in bounties. This collaboration with the research community has resulted in significant improvements in Edge security and has allowed us to offer more proactive security for our customers. Keeping in line with our philosophy of protecting customers and proactively partnering with researchers, today we are changing the Edge on Windows Insider Preview (WIP) bounty program from a time bound to a sustained bounty program. Since 2013, we have launched three browser bounties to uncover specific vulnerabilities. As security is a continuous effort and not a destination, we prioritize identifying different types of vulnerabilities in different points of time. On August 4, 2016, we launched the Edge Web Platform bounty on WIP to incentivize researchers to send us remote code execution (RCE), same [ more… ]