Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking.
Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and container software. The changelog runs to hundreds of entries, so anyone planning to read the whole thing might want to put the kettle on.
Microsoft’s release notes contain more than 470 CVE references, although some vulnerabilities appear multiple times because they affect different packages. So that’s not necessarily 470 separate security holes, but it’s still an impressive amount of patching for one release.
Read more…
Source: The Register News
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- PoC Attack Escalates MikroTik Router Bug to ‘As Bad As It Gets’
October 7, 2018
A new hacking technique used against vulnerable MikroTik routers gives attackers the ability to execute remote code on affected devices. The technique is yet another security blow against the MikroTik router family. Previous hacks have left the routers open to device failures, cyptojacking and network eavesdropping. The hacking technique, found by Tenable Research and outlined on ...
- Facebook security breach: Up to 50m accounts attacked
September 28, 2018
Facebook has said “almost 50 million” of its users were left exposed by a security flaw. The company said attackers were able to exploit a vulnerability in a feature known as “View As” to gain control of people’s accounts. The breach was discovered on Tuesday, Facebook said, and it has informed police. Users that had potentially been affected ...
- New Linux Kernel Bug Affects Red Hat, CentOS, and Debian Distributions
September 26, 2018
Security researchers have published the details and proof-of-concept (PoC) exploits of an integer overflow vulnerability in the Linux kernel that could allow an unprivileged user to gain superuser access to the targeted system. The vulnerability, discovered by cloud-based security and compliance solutions provider Qualys, which has been dubbed “Mutagen Astronomy,” affects the kernel versions released between ...
- Over 80 Cisco Products Affected by FragmentSmack DoS Bug
September 25, 2018
Cisco is currently looking into its product line to determine which products and services use Linux kernel 3.9 or above, which is vulnerable to the FragmentSmack denial-of-service (DoS) bug. The networking hardware manufacturer already assembled a list of more than 80 products that are affected by the vulnerability. Many of them expect a fix by February ...
- macOS Mojave Privacy Bypass Flaw Allows Access to Protected Files
September 24, 2018
A security researcher shows on Mojave’s release day that Apple’s latest privacy protection implementations in macOS are not sufficiently strong. In a minute-long clip, Patrick Wardle shows that the security in the dark-themed macOS can be bypassed to reach sensitive user data, such as the information in the address book. Talking to BleepingComputer, Wardle says that he ...
- Cisco: We’ve killed another critical hard-coded root password bug, patch urgently
September 24, 2018
Cisco has supplied a patch for its Video Surveillance Manager software to erase hardcoded default credentials for the root account. Admins responsible for appliances running Cisco’s surveillance software should urgently patch the flaw, which has a Common Vulnerability Scoring System (CVSS) version 3 score of 9.8 out of a possible 10. The flaw would allow an attacker ...