Security Leftovers

posted by Roy Schestowitz on Jun 19, 2025

• Trail of Bits ☛ Unexpected security footguns in Go's parsers

  File parsers in Go contain unexpected behaviors that can lead to serious security vulnerabilities. This post examines how JSON, XML, and YAML parsers in Go handle edge cases in ways that have repeatedly resulted in high-impact security issues in production systems. We explore three real-world attack scenarios: marshaling/unmarshaling unexpected data, exploiting parser differentials, and leveraging data format confusion. Through examples, we demonstrate how attackers can bypass authentication, circumvent authorization controls, and exfiltrate sensitive data by exploiting these parser behaviors.

• LWN ☛ Security updates for Wednesday

  Security updates have been issued by Debian (gst-plugins-bad1.0, konsole, and libblockdev), Oracle (buildah, containernetworking-plugins, gimp, git-lfs, gvisor-tap-vsock, kernel, libvpx, podman, and skopeo), Red Hat (apache-commons-beanutils and thunderbird), Slackware (xorg), SUSE (gdm, golang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter, golang-github-prometheus-prometheus, govulncheck-vulndb, grafana, kernel, Multi-Linux Manager, Multi-Linux Manager Client Tools, openssl-3, pam, python-cryptography, python-requests, python-setuptools, python3-requests, SUSE Manager Server, systemd, ucode-intel, xorg-x11-server, and xwayland), and Ubuntu (dwarfutils, mujs, node-katex, xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04, and xorg-server, xwayland).

• Ubuntu ☛ Fixes available for local privilege escalation vulnerability in libblockdev using udisks

  The two vulnerabilities are used as part of an exploit chain to escalate privileges from an unprivileged user to polkit allow_active (representing physical console users) and then from polkit allow_active to root. Because the first vulnerability does not apply to default Ubuntu configurations, privilege escalation can only be achieved through physical console access with default polkit rules.

• Security Week ☛ Linux Security: New Flaws Allow Root Access, CISA Warns of Old Bug Exploitation

  Qualys has disclosed two GNU/Linux vulnerabilities that can be chained for full root access, and CISA added a flaw to its KEV catalog.

• OpenSSF (Linux Foundation) ☛ Member Spotlight: Datadog – Powering Open Source Security with Tools, Standards, and Community Leadership

• NETSCOUT warns of new hacktivist threat posing global risks, from the US, Middle East, Africa and beyond

  DieNet, a newly emerged hacktivist group, has claimed responsibility for more than 60 distributed denial-of-service (DDoS) attacks in just two months, including its most recent and widely reported action: the global disruption of X (formerly Twitter).

• Linuxiac ☛ Amazon Linux 2023 Secures FIPS 140-3 Certification

  AWS has reached a major security milestone with its Amazon Linux 2023 (AL2023), a Fedora-based distro developed and maintained by AWS and specifically optimized for use on Amazon’s cloud infrastructure, achieving FIPS 140-3 Level 1 validation for its cryptographic modules.

• Security Week ☛ Gerrit Misconfiguration Exposed Surveillance Giant Google Projects to Malicious Code Injection

  Misconfigured permissions in Google’s Gerrit code collaboration platform could have led to the compromise of ChromiumOS and other Surveillance Giant Google projects.

• dwaves.de ☛ never change a working system, but scary updates are required for all internet connected devices (Pwn2Own.com hacking contest proofs that)

• Security Week ☛ Chrome 137 Update Patches High-Severity Vulnerabilities

  Google has released a Chrome 137 update to resolve two memory bugs in the browser’s V8 and Profiler components.

• Security Week ☛ Data Breach at Healthcare Services Firm Episource Impacts 5.4 Million People

  Hackers have stolen personal and health information belonging to the customers of healthcare organizations served by Episource.

• Security Week ☛ Code Execution Vulnerabilities Patched in Veeam, BeyondTrust Products

  Veeam and BeyondTrust have resolved several vulnerabilities that could be exploited for remote code execution.

• Windows TCO / Windows Bot Nets

  • Security Week ☛ Critical Vulnerability Patched in Citrix NetScaler

    Citrix has released patches for critical- and high-severity vulnerabilities in NetScaler and Secure Access Client and Workspace for Windows.