Bigger than Heartbleed, 'Venom' security vulnerability threatens most datacenters

[anon96526692]

Vulnerability ‘Venom’

http://venom.crowdstrike.com/

[maxaura]

Hosts, virtual machines. Floppy drive controllers code (Xen, KVM, VirtualBox) in QEMU. May be possible to craft memory overflow in code to execute code, therefore attacker reads memory in virtual machines on the host. VMs running data apps means may be vulnerable to data exposure.

[4M8B]

Here’s another nice one if you’re interested … As am busy with reading about exploitation techniques last weeks I also read this one.
Goes pretty deep and pretty advanced for a novice like me but still interesting to see how much possibilities exist in today architectures…

Worst vulnerability since heartbleed. Javascript side channel, 80% of all PCs in the world vulnerable

An anonymous reader writes: Bruce Upbin at Forbes reports on a new and insidious way for a malicious website to spy on a computer. Any computer running a late-model Intel microprocessor and a Web browser using HTML5 (i.e., 80% of all PCs in the world) is vulnerable to this attack. The exploit, which the researchers are calling “the spy in the sandbox,” is a form of side-channel attack. Side channel attacks were previously used to break into cars, steal encryption keys and ride the subway for f…