-
OpenSUSE Backports SLE-15-SP3 watchman suffers from design flaw (26-01-2022)
Preface: What are backports in traditional Linux?“Backporting” is the process of making new software run on something old. A version of something new that’s been modified to run on something old is called a “backport”. The Backports Project develops tools to automate the backporting process for Linux drivers. These tools form the backports suite. Background:…
-
Does this concept like CVE-2022-23008? (26-01-2022)
Preface: NGINX Controller provides lightning-fast application delivery and API management for modern app teams. Background: What is a Data Plane? The data plane is a layer of service proxies that manage application-level network traffic. Data plane typically operate on Layer 7 (application) traffic, although they may also operate at Layer 4 (transport) traffic as well.…
-
CVE-2022-23852 – Prevent Expat (XML_GetBuffer) Signed integer overflow (24-01-2022)
Preface: Expat is free software. You may copy, distribute, and modify it under the terms of the License contained in the file COPYING distributed with this package. This license is the same as the MIT/X Consortium license. Background: As a open-source XML parser, Expat can be implemented by several programming languages, such as: Python, PHP,Perl,…etc.…
-
Are you worried when jerryscript has vulnerabilities? (24th Jan, 2022)
Preface: Samsung Electronics has started the development of IoT.js on 2015, a platform for IoT applications written in JavaScript, and JerryScript, a JavaScript engine for small, embedded devices. Background: JerryScript is an ultra-lightweight JavaScript engine for the Internet of things. It is capable of executing ECMAScript 5.1 source code on devices with less than 64…
-
Get rid of crafted Modbus traffic to bother your defense mechansim – 21st JAN 2022
Preface: Le Rouge et le Noir – Not a bad guy is good guy. If, the vulnerability is due to an integer overflow when handling Modbus traffic. Is it an early warning? Background: The reason Modbus was so successful was the fact that it could be so readily understood by non-programmers. Engineers who built glue…
-
Regarding to ManageEngine security announcement (CVE-2021-44757), do you have doubt on their design? (19-1-2022)
Preface: Asset scan is the key function to maintain the asset management integrity. If the company structure not operating standalone. In some circumstance, the system architect will formalize a distributed architecture. However, how to scan and collecting data is a important topic. Perhaps the file size is variable because of the data content. As a…
-
Oracle Releases January 2022 Critical Patch Update – Quick and easy understanding of CVE-2021-2351 (Oracle JDBC Native Network Encryption design limitation).
Preface: Even thought CVE-2021-2351 was announced on last year (21st July, 2021), however this topic still lure of my interest. As we know, web server and DB server is an important component in existing digital World. For example, Big data, IoT, automotive and mobility functions will working with front end web server. Whereby in between…
-
About CVE-2022-0240 Do not contempt low risk vulnerability (17th Jan,2022)
Preface: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Background: MRuby is the lightweight implementation of the Ruby language complying to (part of) the ISO standard. Its syntax is Ruby 2[.]x compatible. MRuby is embeddable. Can be…
-
CVE-2022-23094 on Libreswan. Stay alert!
Preface: Pluto is an IKE (“IPsec Key Exchange”) daemon. Pluto is an implementation of IKE. It runs as a daemon on a network node. Currently, this network node must be a LINUX system running the KLIPSor NETKEY implementation of IPsec, or a FreeBSD/NetBSD/Mac OSX system running the KAME implementation of IPsec. Background: Libreswan is a…
-
Prophecy astrology and astronomical phenomenon (16th Jan, 2022)
Preface: The history of Vedic astrology, some said it’s been around since 10,000 B.C! Synopsis: About Prophecy astrology: Vedic astrology refers to Indian or Hindu astrology, a system that originated in ancient India and was recorded by saints in the Vedic scriptures. Also known as “Jyotish” – the science of light Vedic astrology involves the…
