Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian LTS: DLA-3155-1: bcel security update
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java cl…
Debian: DSA-5206-1: trafficserver security update
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in HTTP request smuggling, cache poiso…
Mageia 2022-0261: java security update
OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) OpenJDK: Unbounded memory allocation when compiling crafted XPat…
Fedora 36: subversion 2022-2af658b090
This update includes the latest stable release of _Apache Subversion_, version **1.14.2**. This update addresses two security issues, `CVE-2021-28544` and `CVE…
SciLinux: SLSA-2022-1487-1 Important: java-1.8.0-openjdk on SL7.x x86_
OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) * OpenJDK: Unbounded memory allocation when compiling crafted XP…
SciLinux: SLSA-2022-1440-1 Important: java-11-openjdk on SL7.x x86_
OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) * OpenJDK: Unbounded memory allocation when compiling crafted XP…
Mageia 2022-0002: log4j security upda
Apache Log4j2 is vulnerable to a remote code execution (RCE) attack where an attacker with permission to modify the logging configuration file can construct a …
CISA, FBI and NSA Publish Joint Advisory and Scanner for Log4j Vulnerabilities
Cybersecurity agencies from Australia, Canada, New Zealand, the U.K., and the U.S. on Wednesday released a joint advisory in response to widespread exploitatio…
Log4j vulnerability now used to install Dridex banking malwa
Threat actors now exploit the critical Apache Log4j vulnerability named Log4Shell to infect vulnerable devices with the notorious Dridex banking trojan or Mete…
Guide: How To Detect and Mitigate the Log4Shell Vulnerability (CVE-2021-44228 & CVE-2021-4504
A few days ago, a serious new vulnerability was identified in Apache log4j v2 and published as CVE-2021-44228 . We were one of the first security companies to …
Mageia 2021-0572: log4j security upda
Updated log4j packages fix security vulnerability: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-refer…
Log4j Flaw Needs Immediate Remediati
After nearly two years of adopting major network and security changes wrought by COVID-19 and hybrid work, weary IT network and security teams didn't need anot…
Log4j: Everything You Need to Know [Update
Security researchers have warned users that attackers are attempting to exploit a critical vulnerability in the Java logging library Apache Log4j. Log4j is a w…
Google’s OSS-Fuzz Tool Now Detects “Log4Shell” Via Jazzer
As the Apache Log4j vulnerability continues to wreak havoc, Google and Code Intelligence have jumped…Google’s OSS-Fuzz Tool Now Detects “Log4Shell” Via Jazzer…
Mageia 2021-0566: log4j security upda
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers wi…
Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released
UPDATE— The severity score of CVE-2021-45046, originally classified as a DoS bug, has since been revised from 3.7 to 9.0, to reflect the fact that an attacker …
Log4j: Everything You Need to Kn
Security researchers have warned users that attackers are attempting to exploit a critical vulnerability in the Java logging library Apache Log4j. Log4j is a w…
Critical 'Log4Shell' Zero-Day Vulnerability Wreaks Havoc Online
A highly critical vulnerability affecting the Apache Log4j library has potentially shaken the internet. This…Critical 'Log4Shell' Zero-Day Vulnerability Wreaks…
Critical ‘Log4Shell’ Zero-Day Vulnerability Wreaks Havoc Online
A highly critical vulnerability affecting the Apache Log4j library has potentially shaken the internet. This…Critical ‘Log4Shell’ Zero-Day Vulnerability Wreaks…
Extremely Critical Log4J Vulnerability Leaves Much of the Internet at Risk
The Apache Software Foundation has released fixes to contain anactivelyexploitedzero-day vulnerability affecting the widely-used Apache Log4j Java-based loggin…
Debian: DSA-5010-1: libxml-security-java security upda
Apache Santuario - XML Security for Java is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a…
Mageia 2021-0485: tomcat security upda
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protec…
Fedora 34: httpd 2021-2a10bc68
This update addresses CVE-2021-42013. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path …
Debian LTS: DLA-2767-1: libxml-security-java security upda
Apache Santuario, XML Security for Java, is vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a…