🧩 3️⃣ Vulnerabilidad crítica en 7-Zip: hackers la están explotando ahora.

Una falla grave en el popular programa de compresión 7-Zip (CVE-2025-11001) permite a atacantes ejecutar código de forma remota cuando un usuario descomprime un archivo ZIP malicioso.

El problema radica en cómo 7-Zip maneja enlaces simbólicos (symlinks): un ZIP confeccionado puede hacer que el programa acceda a carpetas no deseadas y ejecute código con permisos elevados.

La vulnerabilidad afecta a todas las versiones anteriores a la 25.00 (es decir, versiones usadas desde 21.02 hasta 24.09).

Ya existe un exploit de prueba de concepto (PoC) público, lo que facilita que delincuentes lo usen en ataques reales.

Aunque 7-Zip lanzó el parche en julio de 2025, muchos sistemas siguen sin actualizarlo: la recomendación urgente es que actualices a la versión 25.00 o superior lo antes posible.

🔒 ¿Herramienta de compresión útil o puerta de entrada para malware?

#Privacidad #Ciberseguridad #7Zip #Vulnerabilidad #Actualiza

https://thehackernews.com/2025/11/hackers-actively-exploiting-7-zip.html

Advierten sobre un exploit PoC para una vulnerabilidad en 7-Zip (CVE-2025-11001)

Vía: @seguinfo

https://blog.segu-info.com.ar/2025/11/advierten-sobre-un-exploit-poc-para-una.html

Asus veröffentlichte drängend-dringende SicherheitsUpdates für alle (!) AUSUS-PCs

Wenn sie einen Asus-PC nutzen, sollten Sie sofort handeln und die empfohlenen Updates einspielen!
ASUS hat wichtige Sicherheitsupdates für den ASUS System Control Interface Service in MyASUS veröffentlicht. Konkret geht es um die Schwachstelle CVE-2025-59373 (Score von 8,5).

Mehr: https://maniabel.work/archiv/568

#MyAsus #Asus #infosec #infosecnews #BeDiS

ASUS has patched a high-severity local privilege escalation flaw (CVE-2025-59373) in MyASUS that allowed elevation to NT AUTHORITY/SYSTEM via the System Control Interface Service. Patch now shipped through Windows Update with updated versions for x64 and ARM.

Full details:
https://www.technadu.com/asus-fixes-high-severity-myasus-vulnerability-that-allows-privilege-escalation-to-system-level-access/614620/

#infosec #vulnerability #ASUS #WindowsSecurity #patchmanagement #CVE2025

⚠️ CVE-2025-66022: Critical RCE in Faction (<1.7.1). Unauthenticated attackers can upload extensions, execute commands, and fully compromise systems. Patch to 1.7.1 now! https://radar.offseq.com/threat/cve-2025-66022-cwe-829-inclusion-of-functionality--623a9be1 #OffSeq #infosec #CVE202566022 #RCE

⚠️ CRITICAL: CVE-2025-64657 in Azure App Gateway enables unauthenticated remote code execution (RCE) via stack-based buffer overflow. No patch yet—limit network access, monitor traffic, and prepare for urgent updates. Full system compromise risk. https://radar.offseq.com/threat/cve-2025-64657-cwe-121-stack-based-buffer-overflow-b2c66871 #OffSeq #Azure #CVE202564657

Shenzhen WiFi repeater command injection is EITW.

https://www.cve.org/CVERecord?id=CVE-2025-34152

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.

https://attackerkb.com/topics/vOQYG5Nn7Y/cve-2025-34152

Unlike many consumer IoT vulnerabilities that remain purely theoretical, CVE-2025-34152 has been observed actively exploited in the wild. In September 2025, multiple Aitemi M300 devices exposed to the internet were found compromised.

cc: @Dio9sys @da_667

#internetOfShit

That's an avenue that I admit I hadn't thought to check before. Seems so simple though.

https://access.redhat.com/security/cve/CVE-2025-13601

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.

Accessibilité et design

• Faux gras, faux italique et fausses colonnes : quels problèmes pour l’accessibilité ? : “S’il peut sembler séduisant de donner du style à texte au moyen d’un générateur en ligne, c’est surtout un très bon moyen de rendre vos contenus inaccessibles.”
• https://www.jwz.org/doc : A collection of writing on technical topics
• CAPTCHAs are over : “Events will need to decide whether they want to protect against bots, or preserve high privacy standards. You will not be able to do both.”
• How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation : “o3 is not infallible. Far from it. There’s still a substantial chance it will generate nonsensical results and frustrate you. What is different, is that for the first time the chance of getting correct results is sufficiently high that it is worth your time and and your effort to try to use it on real problems.”
• https://contribute.design : to help designer to contribute in open source software dev
• https://larobustesse.org : “Tant que l’on ne critiquera pas la performance, dogme de l’économie de guerre, rien de durable ne pourra advenir.”

#NotesHebdo

#accessibilité #design #LLM #NotesHebdo #opensource #security

https://lascapi.fr/blog/2025/11/26/accessibilite-et-design/

Resetting the "It has been __ days since an ASN.1 vuln."

https://www.cve.org/CVERecord?id=CVE-2025-12816

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

To be a little more specific about the problem I'm interested in solving, this is a potential building block for an image processing pipeline for ActivityPub software. Mastodon uses ImageMagick, which is an old and well tested image manipulation tool, but it's only as sandboxed as the Mastodon server itself. Any vulnerability in ImageMagick leaves an attacker in a position to do anything the Mastodon server can do. That's an uncomfortable place to be because image library compromise isn't an outlandish possibility. It has happened a lot (check out this recent libtiff CVE: https://nvd.nist.gov/vuln/detail/CVE-2025-9900). And I don't mean to say their developers are bad at what they do. Images are complex and this is a really hard problem!