-
About CVE-2021-3802, Fedora & Ubuntu already address this matter, it is a reminder (29-11-2021).
Preface: (2021-07-30) Reported to KDE and GNOME development teams – In response, patches for both kio and glib were implemented.However, both projects rely mainly on udisks and use own code only as fallback. Background: Ubuntu used to have Unity desktop in its default edition but it switched to GNOME desktop since version 17.10 release.Ubuntu offers…
-
CVE-2021-23654 – This affects all versions of package html-to-csv. The flaw let threat actor can embed or generate a malicious link or execute commands via CSV files (26-11-2021)
Preface: CSV file is a useful thing in today’s world when we are talking about machine learning, data handling, and data visualization. Background: There are many Raw storage bucket for big data analytic. You might store it in a text format such as JavaScript Object Notation (JSON) or comma-separated values (CSV), or perhaps even Apache…
-
About Zoom vulnerability CVE-2021-34423 (25-11-2021)
Preface: What if you need to decide to buy remote meeting software? In front of you, Microsoft Teams, Zoom, and Cisco WebEx. What is your final decision? Or you decide to buy all, because all three items have design weakness but it is under enhancement. Background: What is H.323 suite H.323 is a standard developed…
-
About CVE-2021-21980 – VMware found SSRF, arbitrary file read flaws in vCenter Server (24-11-2021)
Preface: VMware Flash End of Life and Supportability (78589) – https://kb.vmware.com/s/article/78589 Background: Flex is a powerful, open source application framework that allows you to build mobile applications for iOS, Android, and BlackBerry Tablet OS devices, as well as traditional applications for browsers and desktops using the same programming model, tool, and codebase. From a platform…
-
CVE-2021-28706 About Xen memory management design weaknesses (24-11-2021)
Preface: Who uses Xen? Amazon Web Services alone runs ½ million virtualized Xen Project instances according to a recent study and other cloud providers such as Rackspace and hosting companies use the hypervisor at extremely large scale. Xen is a type-1 bare-metal hypervisor. Background: A Xen host will run a number of virtual machines, VMs,…
-
About NVIDIA GPU vulnerabilities -22nd Nov 2021
Preface: NVIDIA, the inventor of the Graphics Processing Unit (GPU) brings visual computing excellence to the embedded world. High performance meets low power with the NVIDIA Tegra processor – get ready for HD video, crisp graphics and unprecedented 3D capabilities, all in one power efficient package. Background: GPUDirect Storage kernel driver nvidia-fs.ko is a kernel…
-
Vulnerabilities discovered so far in GCC c++filt v2.26.Is it all solved now? (18-11-2021)
Preface: Not limited to traditional Linux, Apple also has cplus-dem[.]c open source. Background: What is GCC used for? GCC stands for GNU Compiler Collections which is used to compile mainly C and C++ language. It can also be used to compile Objective C and Objective C++. File (cplus-dem.c) lives in both GCC and libiberty. Cplus-dem[.]cis…
-
CVE-2021-43997 – Amazon FreeRTOS encounter vulnerability (18th Nov, 2021)
Preface: Amazon now “owns” FreeRTOS, in the sense that the company will provide all support going forward. FreeRTOS includes a kernel and a growing set of software libraries suitable for use across industry sectors and applications. To support a growing number of use cases, AWS provides software libraries that offer enhanced functionality including connectivity, security,…
-
Security Focus on SMU Mailbox (CVE-2021-26331) -16th Nov 2021
Preface: Quick way to understand difference in between Ryzen and EPYC (see below): About Ryzen: Some said, Ryzen CPUs are best suited for gaming PCs.However, AMD has announced its newest range of mobile chips,the Ryzen 5000 mobile series, which it claims will be used in 1500 devices during 2021. About EPYC: AMD and Google Cloud…
-
Review of major events (from windows 7 to AMD display driver design weakness) 15th Nov, 2021
Preface: Long time ago, digital world try to avoid malware infection. Malware has few different types. Memory-resident malware, also known as fileless malware, is a type of malicious software that writes itself directly onto a computer’s system memory. This behavior leaves very few signs of infection, making it difficult for traditional tools and non-experts to…