'"Earlier this week, Google released an emergency security update for
the Chrome browser due to a vulnerability that is being actively
exploited in the wild," reports Hot Hardware:
On Friday, Google highlighted CVE-2023-2033, reported by Clément
Lecigne of Google's own Threat Analysis Group (TAG). This
vulnerability is a 'type confusion' bug in the JavaScript engine for
Chromium browsers useing the V8 Javascript engine. In short, type
confusion is a bug that allows memory to be accessed with the wrong
type, allowing for the reading or writing of memory out of bounds. The
CVE page says that an attacker could create an HTML page that allows
the exploitation of heap corruption.
While there is no Common Vulnerability Scoring System (CVSS) score
attached to the vulnerability yet, Google is tracking this as a "high"
severity issue. This is likely due in part to the fact that "Google is
aware that an exploit for CVE-2023-2033 exists in the wild."
The article notes that Chrome updates are generally done
automatically, but you can also check for updates by clicking Chrome's
three-dots menu in the top-right corner, then "Help" and "About
Chrome."'
-- source: https://it.slashdot.org/story/23/04/16/2057239
Cheers, Peter
--
Peter Reutemann
Dept. of Computer Science
University of Waikato, Hamilton, NZ
Mobile +64 22 190 2375
https://www.cs.waikato.ac.nz/~fracpete/http://www.data-mining.co.nz/
Here’s another interesting development in the Windows-Linux rivalry: in
gaming, of all places. The Steam Deck is a Linux-based handheld gaming
PC which could, in principle, run Windows. Trouble is, Windows doesn’t
offer any good UI options for working with this form factor
<https://arstechnica.com/gadgets/2023/04/handheld-mode-for-windows-could-mak…>.
So there is talk of developing a new “handheld mode” for Windows. Of
course, for Linux, there is no “mode” in the OS for this, it’s just a
different configuration of the GUI layer. Which is modular and
completely replaceable.
Something else to worry about: the US FBI, and NZ CERT, are advising
travellers not to use public USB charging ports, because they can be a
way to hack into your device
<https://www.nzherald.co.nz/travel/fbi-warns-travellers-not-to-use-public-ch…>.
When I was in Hong Kong Airport a few years ago, it was very hard for
me to find a mains outlet to charge my laptop. Just about all the ports
built into the public seating areas were USB ones, for phones/tablets.
CANbus is a mini-LAN built into every car manufactured this century. It
is increasingly being used for all kinds of functions, like controlling
“smart headlamps”, and of course unlocking the doors and letting you
get into the car and drive off.
Now it turns out that there are ways to connect to the bus through weak
points from outside the vehicle, for example by breaking into the
connections for those “smart headlamps”. From here, you can do things
like spoof signals from the smart key receiver, fooling the security
system into thinking it has received a signal from a valid owner’s key
when it hasn’t.
And once you’ve done that, you can steal the car.
Because, of course, components on the bus are trusting the signals they
get from other components, aren’t they?
<https://www.theregister.com/2023/04/06/can_injection_attack_car_theft/>
