Lol. @HackenProof a reputable bug bounty platform sends out invites for their program to attack Russian critical infrastructure (SCADA, banks, energy). Crazy times & Happy hunting. #StandingWithUkraine https://t.co/2Sc6bvXzTP
0day RCE in #Ghostscript going wild. This issue was found independently by @emil_lerner and @jensvoid. Fun fact: GS is everywhere. Even LESS(1) is affected.
@RDerenzy@emil_lerner ImageMagick is *not* required (but can be used as a vector to call Ghostscript). The 9.50 to 9.54 releases are vulnerable. I don't use Windows.
@1AKDJ@emil_lerner Kali Rolling (less 551); likes to convert all kinds of obscure file types to plain text before displaying to the user; thereby increasing the attack surface
@lambdafu & @jurajsomorovsky evaluate the real-world attack surface of web browsers and widely-deployed email and FTP servers in lab experiments and with internet-wide scans in this #BHUSA Briefing https://t.co/c7EF2aaFOY
We found another flaw in the design of TLS! If you have servers that share certificates across services you might want to take a look at this: https://t.co/jwRODhaHmE. 🧵👇
My fault. Even though Thunderbird removed the mailto:?attach feature, it still seems present in distros that apply xdg-email to parse mailto URLs.
Thanks to @j_o_n__w and @Ug_0Security for all the debugging :).
Original report for Thunderbird now public: https://t.co/IIeOL7FNhX
Have you ever heard of the mailto:?attach=~/… parameter? It allows to include arbitrary files on disk. So, why break PGP if you can politely ask the victim's mail client to include the private key? (1/4)
@j_o_n__w @Ug_0Security Sry, the line is "ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach='..." in the run_thunderbird() function of xdg-email. Thanks.
@j_o_n__w @Ug_0Security Can you confirm that you are using xdg-email (e.g., by commenting out line 51 in /usr/bin/xdg-email and then testing if it still works)?
@JamesHenstridge@jensvoid Yes. See me other answer, for some reason this escaped KDE Security Team radar and i thought it had not been reported to KDE while it had indeed been.