[FD] Executable installers are vulnerable^WEVIL (case 58): Intel® Processor Identification Utility - Windows* Version - arbitrary code execution with escalation of privilege

Hi @ll, Intel® Processor Identification Utility - Windows* Version, version 6.0.0211 from 2019-02-11, available from via , and earlier versions 6.0.* ar

[FD] [CVE-2019-20358] CVE-2019-9491 in Trend Micro Anti-Threat Toolkit (ATTK) was NOT properly FIXED

Hi @ll, on September 29, 2019, John Page reported a remote code execution with escalation of privilege in TrendMicro's Anti-Threat Toolkit to its vendor. TrendMicro assigned CVE-2019-9491 to this vulnerability and told the reporter, his dog and the world on October 18, 2019, that they had fixed th

[FD] LPE and RCE in OpenSMTPD (CVE-2020-7247)

Qualys Security Advisory LPE and RCE in OpenSMTPD (CVE-2020-7247) == Contents == Summary Analysis Exploitation Acknowledgments =

[FD] Defense in depth -- the Microsoft way (part 61): security features are built to fail (or documented wrong)

Hi @ll, (a long[er] form of the following advisory is available at ) With Windows 10 1607, Microsoft introduced the /DEPENDENTLOADFLAG linker option, a security feature to restrict or limit the search path for DLLs: | On supported operating syste

[FD] APPLE-SA-2020-1-29-2 iCloud for Windows 10.9.2

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-29-2 iCloud for Windows 10.9.2 iCloud for Windows 10.9.2 is now available and addresses the following: ImageIO Available for: Windows 10 and later via the Microsoft Store Impact: Processing a maliciously crafted image may lead to ar

[FD] APPLE-SA-2020-1-29-1 iCloud for Windows 7.17

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-29-1 iCloud for Windows 7.17 iCloud for Windows 7.17 addresses the following: ImageIO Available for: Windows 7 and later Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-boun

[FD] APPLE-SA-2020-1-28-6 iTunes for Windows 12.10.4

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-6 iTunes for Windows 12.10.4 iTunes for Windows 12.10.4 is now available and addresses the following: Mobile Device Service Available for: Windows 7 and later Impact: A user may gain access to protected parts of the file system D

[FD] APPLE-SA-2020-1-28-5 Safari 13.0.5

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-5 Safari 13.0.5 Safari 13.0.5 is now available and addresses the following: Safari Available for: macOS Mojave and macOS High Sierra, and included in macOS Catalina Impact: Visiting a malicious website may lead to address bar spo

[FD] APPLE-SA-2020-1-28-4 tvOS 13.3.1

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-4 tvOS 13.3.1 tvOS 13.3.1 is now available and addresses the following: Audio Available for: Apple TV 4K and Apple TV HD Impact: An application may be able to execute arbitrary code with system privileges Description: A memory co

[FD] APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-1 iOS 13.3.1 and iPadOS 13.3.1 iOS 13.3.1 and iPadOS 13.3.1 are now available and address the following: Audio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation Impact:

[FD] APPLE-SA-2020-1-28-3 watchOS 6.1.2

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-3 watchOS 6.1.2 watchOS 6.1.2 is now available and addresses the following: AnnotationKit Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrar

[FD] APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra macOS Catalina 10.15.3, Security Update 2020-001 Mojave, and Security Update 2020-001 High Sierra are now available and address the fo

[FD] [CFP] leHACK - June 26 - June 27, 2020

Hello everyone, For the second edition, leHACK will be held at la Cité des Sciences et de l'Industire, in Paris, on June 26 & 27 2020. Since our community and the team enjoyed the site from the last year, it wasn't hard to pick a location, which hosted la Nuit du Hack and leHACK for the previou

Re: [FD] Multiple vulnerabilities in TOTOLINK and other Realtek SDK based routers

UPDATE: As there is no response from direct vendors (TOTOLINK and other) and because the vulnerablity has a big impact (CVSSv3: 9.6, 70k vulnerable devices on Internet) I decided to publish the exploit code: https://sploit.tech/files/CVE-2019-19822-19825-exploit.sh I kindly ask to spread informati