News: 0000832276

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Security updates for Wednesday

([Security] Sep 23, 2020 14:44 UTC (Wed) (ris))


Dist.

ID

Release

Package

Date

openSUSE

[1]openSUSE-SU-2020:1505-1

libetpan

2020-09-22

openSUSE

[2]openSUSE-SU-2020:1501-1

15.2

libqt4

2020-09-22

openSUSE

[3]openSUSE-SU-2020:1506-1

lilypond

2020-09-22

openSUSE

[4]openSUSE-SU-2020:1509-1

otrs

2020-09-23

openSUSE

[5]openSUSE-SU-2020:1502-1

15.1

perl-DBI

2020-09-22

Red Hat

[6]RHSA-2020:3810-01

MRG2

kernel-rt

2020-09-22

Slackware

[7]SSA:2020-266-01

seamonkey

2020-09-22

SUSE

[8]SUSE-SU-2020:2715-1

SES5

grafana

2020-09-22

SUSE

[9]SUSE-SU-2020:2711-1

SLE12

libmspack

2020-09-22

SUSE

[10]SUSE-SU-2020:2712-1

SLE15

openldap2

2020-09-22

SUSE

[11]SUSE-SU-2020:2714-1

OS9 SLE12

ovmf

2020-09-22

SUSE

[12]SUSE-SU-2020:2713-1

SLE15

ovmf

2020-09-22

SUSE

[13]SUSE-SU-2020:2718-1

OS8

pdns

2020-09-23

SUSE

[14]SUSE-SU-2020:2710-1

SLE15

rubygem-actionpack-5_1

2020-09-22

SUSE

[15]SUSE-SU-2020:2724-1

OS7 SLE12

samba

2020-09-23

SUSE

[16]SUSE-SU-2020:2721-1

OS8 OS9 SLE12 SES5

samba

2020-09-23

SUSE

[17]SUSE-SU-2020:2720-1

SLE12

samba

2020-09-23

SUSE

[18]SUSE-SU-2020:2719-1

SLE15

samba

2020-09-23

SUSE

[19]SUSE-SU-2020:2722-1

SLE15 SES6

samba

2020-09-23

Ubuntu

[20]USN-4530-1

18.04

debian-lan-config

2020-09-22

Ubuntu

[21]USN-4533-1

20.04

ldm

2020-09-22

Ubuntu

[22]USN-4534-1

12.04 14.04 16.04 18.04

libdbi-perl

2020-09-23

Ubuntu

[23]USN-4532-1

18.04

netty-3.9

2020-09-22



[1] https://lwn.net/Articles/832254/

[2] https://lwn.net/Articles/832255/

[3] https://lwn.net/Articles/832256/

[4] https://lwn.net/Articles/832257/

[5] https://lwn.net/Articles/832258/

[6] https://lwn.net/Articles/832253/

[7] https://lwn.net/Articles/832259/

[8] https://lwn.net/Articles/832260/

[9] https://lwn.net/Articles/832261/

[10] https://lwn.net/Articles/832262/

[11] https://lwn.net/Articles/832264/

[12] https://lwn.net/Articles/832263/

[13] https://lwn.net/Articles/832265/

[14] https://lwn.net/Articles/832266/

[15] https://lwn.net/Articles/832271/

[16] https://lwn.net/Articles/832269/

[17] https://lwn.net/Articles/832268/

[18] https://lwn.net/Articles/832267/

[19] https://lwn.net/Articles/832270/

[20] https://lwn.net/Articles/832272/

[21] https://lwn.net/Articles/832273/

[22] https://lwn.net/Articles/832274/

[23] https://lwn.net/Articles/832275/

Security Holes Found In Microsoft Easter Eggs

REDMOND, WA -- It's damage control time for the Microsoft Marketing
Machine. Not only have exploits been found in IE, Outlook, and even the
Dancing Paper Clip, but now holes have been uncovered in Excel's Flight
Simulator and Word's pinball game.

"If you enter Excel 97's flight simulator and then hit the F1, X, and
SysRq keys while reading a file from Drive A:, you automatically gain
Administrator rights on Windows NT," explained the security expert who
first discovered the problem. "And that's just the tip of the iceberg."

Office 97 and 2000 both contain two hidden DLLs, billrulez.dll and
eastereggs.dll, that are marked as "Safe for scripting" but are not.
Arbitrary Visual BASIC code can be executed using these files. More
disturbing, however, are the undocumented API calls
"ChangeAllPasswordsToDefault", "OpenBackDoor", "InitiateBlueScreenNow",
and "UploadRegistryToMicrosoft" within easter~1.dll.

Microsoft spokesdroids have already hailed the problem as "an
insignificant byproduct of Microsoft innovation."