Security Leftovers
-
LWN ☛ Security updates for Friday
Security updates have been issued by Fedora (chromium, firefox, and podman), Mageia (chromium-browser-stable, ghostscript, and java-1.8.0, java-11, java-17, java-latest), Red Hat (bind, Firefox, firefox, gnutls, httpd:2.4, and thunderbird), SUSE (glibc, opera, and python-Pillow), and Ubuntu (dotnet7, dotnet8, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4,
linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.5, linux-azure, linux-azure-6.5, linux-gcp,
linux-gcp-6.5, linux-hwe-6.5, linux-laptop, linux-lowlatency,
linux-lowlatency-hwe-6.5, linux-nvidia-6.5, linux-oem-6.5, linux-oracle,
linux-oracle-6.5, linux-raspi, linux-signed, linux-signed-aws,
linux-signed-aws-6.5, linux-starfive, linux-starfive-6.5, linux, linux-aws, linux-azure-4.15, linux-gcp-4.15, linux-hwe, linux-kvm,
linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, and linux, linux-azure, linux-azure-5.15, linux-azure-fde,
linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gkeop,
linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15,
linux-nvidia, linux-oracle, linux-raspi).
-
Diffoscope ☛ Reproducible Builds (diffoscope): diffoscope 267 released
The diffoscope maintainers are pleased to announce the release of diffoscope version
267. This version includes the following changes:* Include "xz --verbose --verbose" (ie. double --verbose) output, not just the single --verbose. (Closes: #1069329) * Only include "xz --list" output if the xz has no other differences.
-
OpenSSF (Linux Foundation) ☛ Where Does Your Software (Really) Come From?
Software is a funny, profound thing: Each piece of it is an invisible machine, seemingly made of magic words, designed to run on the ultimate, universal machine. It’s not alive, but it has a lifecycle. It starts out as source code—just text files sitting in a repository somewhere—and then later (through some unique process), that source gets built into something else. A chunk of minified JavaScript delivered to a web server, a container image full of framework code and business logic, a raw binary compiled for a specific processor architecture.
-
Security Week ☛ In Other News: MediSecure Hack, Scattered Spider Targeted by FBI, New Wi-Fi Attack
Noteworthy stories that might have slipped under the radar: FBI is targeting Scattered Spider, Australia’s MediSecure hacked, new Wi-Fi attack.
-
Security Week ☛ CISA Warns of Exploited Vulnerabilities in EOL D-Link Products
CISA has added two vulnerabilities in discontinued D-Link products to its KEV catalog, including a decade-old flaw.
-
Security Week ☛ New ‘Antidot’ Android Trojan Allows Cybercriminals to Hack Devices, Steal Data
The Antidot Android banking trojan snoops on users and steals their credentials, contacts, and SMS messages.