article thumbnail

A zero-day exploit for Log4j Java library could have a tsunami impact on IT giants

Security Affairs

Experts publicly disclose Proof-of-concept exploits for a critical zero-day vulnerability in the Apache Log4j Java-based logging library. Experts publicly disclose Proof-of-concept exploits for a critical remote code execution zero-day vulnerability, tracked a CVE-2021-44228 (aka Log4Shell ), in the Apache Log4j Java-based logging library.

Libraries 364
article thumbnail

Latest OpenSSL version is affected by a remote memory corruption flaw

Security Affairs

Expert discovered a remote memory-corruption vulnerability affecting the latest version of the OpenSSL library. The library was released on June 21, 2022, and affects x64 systems with the AVX-512 instruction set. Benjamin also found an apparent bug in the paper by Shay Gueron upon which the RSAZ code is based.

Libraries 328
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

I Am Parting With My Crypto Library

Schneier on Security

The time has come for me to find a new home for my (paper) cryptography library. New owner pays all packaging and shipping costs, and possibly a purchase price depending on who you are and what you want to do with the library. If you think you can break it up and sell it, I’ll consider that as a last resort.

Libraries 145
article thumbnail

Google found zero-click vulnerabilities in Apple’s multimedia processing components

Security Affairs

The discovery urges Apple into implementing additional security measures to protect these components, following the approach already adopted by Google to protect multimedia processing libraries. Multimedia processing libraries are used by the modern mobile OS to automatically manage multimedia files (i.e. images, audio, and videos).

Libraries 361
article thumbnail

5 Early Indicators Your Embedded Analytics Will Fail

In this White Paper, Logi Analytics has identified 5 tell-tale signs your project is moving from “nice to have” to “needed yesterday.". Many application teams leave embedded analytics to languish until something—an unhappy customer, plummeting revenue, a spike in customer churn—demands change. But by then, it may be too late.

article thumbnail

Researchers released a free decryption tool for the Rhysida Ransomware

Security Affairs

” reads the paper published by the researchers “We successfully decrypted the data using the regenerated random number generator. ” reads the paper. The Rhysida ransomware uses CSPRNG, which is based on the ChaCha20 algorithm provided by the LibTomCrypt library. ” continues the paper.

article thumbnail

Experts found critical RCE in Spotify’s Backstage

Security Affairs

The issue can be exploited by triggering a recently disclosed VM sandbox escape vulnerability (CVE-2022-36067 aka Sandbreak) in the vm2 third-party library. The researchers explained that the template engine utilizes the vm2 library to prevent the execution of untrusted code. ” reads the advisory published by Oxeye.

Libraries 302