Microsoft this week patched a remote code execution vulnerability affecting the wimgapi library, which is used to perform operations on Windows Imaging Format (WIM) files.
http://feedproxy.google.com/~r/Securityweek/~3/9MQxbgQY67c/microsoft-patches-code-execution-vulnerability-wimgapi-library
Schneider Electric recently patched four vulnerabilities in its U.motion Builder software, including two critical command execution flaws. Advisories have been published by both the vendor and ICS-CERT.
http://feedproxy.google.com/~r/Securityweek/~3/vD6Y6SJ5sJo/critical-flaws-patched-schneider-building-automation-software
Siemens this week published five new security advisories describing several vulnerabilities discovered in its switches, routers, building automation products, and medical devices.
http://feedproxy.google.com/~r/Securityweek/~3/vIzzPomydAc/siemens-patches-vulnerabilities-scalance-other-devices
GnuPG recently addressed an input sanitization vulnerability where a remote attacker could spoof arbitrary signatures.
http://feedproxy.google.com/~r/Securityweek/~3/XrqLORFlaRM/gnupg-vulnerability-allows-spoofing-message-signatures
One of the vulnerabilities Microsoft addressed with the June 2018 security patches was a flaw in Cortana that could allow an attacker to elevate privileges and execute code from the lock screen.
http://feedproxy.google.com/~r/Securityweek/~3/afVvCNU_CZ4/cortana-flaw-allows-code-execution-lock-screen
Intel and software vendors have started informing users about a new vulnerability involving side channel speculative execution that could be exploited by malicious actors to obtain sensitive information from the targeted system.
http://feedproxy.google.com/~r/Securityweek/~3/4iVRNxlK5_4/meltdown-lazyfp-vulnerability-impacts-intel-cpus
Exploit kits (EKs) might not be as dominant as they were several years ago, but they continue to exist and most of them already adopted exploits for recently discovered Flash and Internet Explorer zero-day vulnerabilities.
http://feedproxy.google.com/~r/Securityweek/~3/KC2eb1t3QYk/exploit-kits-target-recent-flash-internet-explorer-zero-days
Of the ten Security Notes in SAP’s June 2018 Security Patch Day, five were updates for previously released Notes, including two rated Hot News (Critical severity).
Impacting SAP Business Client (version 6.5) and SAP BASIS (versions 7.31, 7.40, 7.50, 7.51, 7.65, 7.66), the two Hot News Security Notes feature CVSS scores of 9.8 and 9.1, respectively.
http://feedproxy.google.com/~r/Securityweek/~3/aXW29IuF-Ik/sap-releases-critical-updates-two-security-notes
Updates released by Microsoft on Tuesday for its Windows operating system add support for a feature that should prevent attacks involving the recently disclosed speculative execution vulnerability known as “Variant 4.”
http://feedproxy.google.com/~r/Securityweek/~3/p8IM7rs1_1k/microsoft-releases-mitigations-spectre-variant-4-attack
Microsoft’s Patch Tuesday updates for June 2018 address a total of 50 vulnerabilities, including nearly a dozen critical remote code execution flaws affecting Windows and the company’s Edge and Internet Explorer web browsers.
http://feedproxy.google.com/~r/Securityweek/~3/BTwD2cLFQNQ/microsoft-patches-11-critical-rce-flaws-windows-browsers