Blogs

CKEditor 3.5.4 Released

http://cksource.com/blog/CKEditor_3.5.4_released

"[This update] includes several fixes and minor enhancements to the
editor. Please note that due to a security issue (XSS, Severity rating:
Less Critical) that was discover recently it is recommended to upgrade
your CKEditor installation to either version 3.5.4 or 3.6."

We recommend updating to the latest version of CKEditor.

Thanks,
ep

Wordpress 3.1.2 security update released

http://wordpress.org/news/2011/04/wordpress-3-1-2/

"This release addresses a vulnerability that allowed Contributor-level
users to improperly publish posts."

"We suggest you update to 3.1.2 promptly, especially if you allow users
to register as contributors or if you have untrusted users. This release
also fixes a few bugs that missed the boat for version 3.1.1."

Thanks,
ep

Wordpress 3.1.2 security update released

http://wordpress.org/news/2011/04/wordpress-3-1-2/

"This release addresses a vulnerability that allowed Contributor-level
users to improperly publish posts."

"We suggest you update to 3.1.2 promptly, especially if you allow users
to register as contributors or if you have untrusted users. This release
also fixes a few bugs that missed the boat for version 3.1.1."

Thanks,
ep

APPLE-SA-2011-04-18-1 iTunes 10.2.2 for Windows

http://support.apple.com/kb/HT4609

"iTunes 10.2.2

WebKit

Available for: Windows 7, Vista, XP SP2 or later

Impact: A man-in-the-middle attack may lead to an unexpected
application termination or arbitrary code execution

Description: Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes may
lead to an unexpected application termination or arbitrary code execution.

CVE-ID

Leaked version of Skype for Android leaks sensitive data

http://nakedsecurity.sophos.com/2011/04/17/skype-for-android-leaks-sensi...

Leaked copies of Skype for Android with video-conferencing capabilities
have been floating around. Before using, note that there is no security
of any kind on your personal & login information. It is literally stored
in text files with world-readable permissions. However, PCI DSS was
followed, so Credit Card information is safe.

Leaked version of Skype for Android leaks sensitive data

http://nakedsecurity.sophos.com/2011/04/17/skype-for-android-leaks-sensi...

Leaked copies of Skype for Android with video-conferencing capabilities
have been floating around. Before using, note that there is no security
of any kind on your personal & login information. It is literally stored
in text files with world-readable permissions. However, PCI DSS was
followed, so Credit Card information is safe.

APPLE-SA-2011-04-18-1 iTunes 10.2.2

http://lists.apple.com/archives/security-announce/2011/Apr/msg00004.html

"Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes
may lead to an unexpected application termination or arbitrary code
execution."

Users of iTunes are strongly encouraged to update their client software
as soon as possible.

Leaked version of Skype for Android leaks sensitive data

http://nakedsecurity.sophos.com/2011/04/17/skype-for-android-leaks-sensi...

Leaked copies of Skype for Android with video-conferencing capabilities
have been floating around. Before using, note that there is no security
of any kind on your personal & login information. It is literally stored
in text files with world-readable permissions. However, PCI DSS was
followed, so Credit Card information is safe.

APPLE-SA-2011-04-18-1 iTunes 10.2.2

http://lists.apple.com/archives/security-announce/2011/Apr/msg00004.html

"Multiple memory corruption issues exist in WebKit. A
man-in-the-middle attack while browsing the iTunes Store via iTunes
may lead to an unexpected application termination or arbitrary code
execution."

Users of iTunes are strongly encouraged to update their client software
as soon as possible.

Adobe to Patch Flash Zero Day on Windows, Mac on Friday, April 15, 2011

https://threatpost.com/en_us/blogs/adobe-patch-flash-zero-day-windows-ma...

Thanks to Kevin for the heads up.

"Adobe is planning to patch the recently disclosed Flash Player
vulnerability on Friday for users on Windows, Mac OS X and Linux. The
vulnerability is being used in targeted attacks right now that use
malicious Word documents.

Pages