Updates released this week by LG for its Android smartphones patch two high severity keyboard vulnerabilities that can be exploited for remote code execution.
http://feedproxy.google.com/~r/Securityweek/~3/cT2lyOy4ScY/lg-patches-serious-vulnerabilities-smartphone-keyboard
SAP this week released its May 2018 set of security patches to address more than a dozen vulnerabilities across its product portfolio, including four bugs in Internet Graphics Server.
http://feedproxy.google.com/~r/Securityweek/~3/0kew_MGVzcA/sap-patches-internet-graphics-server-flaws
Siemens has released updates for many of its SINAMICS medium voltage converters to address two remotely exploitable denial-of-service (DoS) vulnerabilities.
http://feedproxy.google.com/~r/Securityweek/~3/VX2qgWGQw3M/siemens-patches-dos-flaws-medium-voltage-converters
The developers of several major operating systems and hypervisors misinterpreted documentation from Intel and introduced a potentially serious vulnerability to their products.
http://feedproxy.google.com/~r/Securityweek/~3/n-2ZJD1hfus/misinterpretation-intel-docs-leads-flaw-hypervisors-oss
As part of its May 2018 Android Security Bulletin, Google this week released additional mitigations for the Meltdown attack that impacts microprocessors from Intel, AMD, and other vendors.
http://feedproxy.google.com/~r/Securityweek/~3/xAXaVZf7paM/google-releases-additional-meltdown-mitigations-android
Enlarge (credit: Lisa Brewster / Flickr)
Microsoft on Tuesday patched two Windows vulnerabilities that attackers are actively exploiting in the wild to install malicious apps on the computers of unwitting users.
The first vulnerability resides in the VBScript Engine included in all currently supported versions of Windows. A so-called use-after-free flaw involving the way the engine handles computer memory allows attackers to execute code of their choice that runs with the same system privileges chosen by the logged-in user. When targeted users are logged in with administrative rights, attackers who exploit the bug can take complete control of the system. In the event users are logged in with more limited rights, attackers may still be able to escalate privileges by exploiting a separate vulnerability.
CVE-2018-8174, as the flaw is formally indexed, is being actively exploited by attackers, Microsoft officials said. The vulnerability was discovered by antivirus provider Kaspersky Lab, which then reported it to Microsoft. In the exploits observed by Kaspersky Lab:
Read 4 remaining paragraphs | Comments
https://arstechnica.com/?p=1306129
Lenovo has released patches for a High severity vulnerability impacting the Secure Boot function on some System x servers.
http://feedproxy.google.com/~r/Securityweek/~3/5p5fk6Fclpc/lenovo-patches-secure-boot-vulnerability-servers
Microsoft has fixed more than 60 vulnerabilities with its May 2018 Patch Tuesday updates, including two Windows zero-day flaws that can be exploited for remote code execution and privilege escalation.
http://feedproxy.google.com/~r/Securityweek/~3/GDQJT6ibKZE/microsoft-patches-two-windows-zero-day-vulnerabilities
Adobe has patched several vulnerabilities in its Flash Player, Creative Cloud and Connect products, but the company believes it’s unlikely that the flaws will be exploited in the wild any time soon.
http://feedproxy.google.com/~r/Securityweek/~3/V80W5Lh1Yjo/critical-code-execution-flaw-patched-flash-player
The Internet of Things (IoT) botnet known as <a href="https://www.securityweek.com/hide-n-seek-iot-botnet-ensnares-20000-devices-days" style="text-d
http://feedproxy.google.com/~r/Securityweek/~3/0xwpv4rtqXE/hide-n-seek-iot-botnet-can-survive-device-reboots
