Cisco Patches DoS, Injection Flaws in Four Security Products
Cisco released security updates for four network security products this week that patch a number of denial of service and command injection vulnerabilities.
Vulnerabilities
OpenSSL Man-in-the-Middle Flaw Fixed in Ruby
The maintainers of Ruby have fixed a serious flaw in its SSL client that could have allowed an attacker to conduct man-in-the-middle attacks by spoofing an SSL server. The vulnerability lies in the OpenSSL toolkit that’s built in to Ruby and is present in several versions of the software from 1.8 through 2.0. An attacker exploiting the […]
14 Vulnerabilities Fixed in Firefox 22
Mozilla has fixed 14 security vulnerabilities in Firefox, including four critical flaws that could allow remote code execution. There also are six high-severity vulnerabilities fixed in Firefox 22.
WordPress’ latest update to the content management system includes patches for seven security vulnerabilities.
Top WordPress plug-ins and themes remain vulnerable to common Web-based attacks such as cross-site scripting and SQL injection.
The Microsoft bug bounty program has been nearly a decade in the making and it is clear from the shape and size of it that the company did not simply slap the program together in order to join the cool kids. Microsoft’s security team spent years watching the way other programs work, seeing what incentives attract good researchers and looking for a system that made sense for Microsoft’s specific goals.
After years of saying that the company didn’t need a bug bounty program, Microsoft is starting one. The company today will announce the start of a new program that will pay security researchers up to $100,000 for serious vulnerabilities and as much as $50,000 for new defensive techniques that help protect against those flaws.
Oracle released 40 patches on Tuesday for Java, most of them fixing remotely executable vulnerabilities in the browser plug-in.
Last week BlackBerry released a security update resolving an escalation of privilege vulnerability that existed in “BlackBerry Protect” enabled devices running version 10.0.10.261 and earlier operating systems. The company claims that version 10.0.9.2743 is not affected and that they have found no evidence of attackers exploiting this vulnerability in the wild.
There is a massive stack of Java patches on deck for tomorrow, with Oracle planning to fix 40 vulnerabilities in a number of different components of Java SE. Nearly all of the vulnerabilities are remotely exploitable. Oracle doesn’t release much in the way of information about the content of its patch updates before the fixes […]
