Slackware Security Advisory - New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.

Slackware Security Advisory - New kernel packages are available for Slackware 14.2 to fix security issues.

Slackware Security Advisory - New mozilla-firefox packages are available for Slackware 14.2 and -current to fix a security issue.

Slackware Security Advisory - New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues.

Slackware Security Advisory - New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues.

Slackware Security Advisory - New sudo packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

Slackware Security Advisory - New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.

Slackware Security Advisory - New mozilla-thunderbird packages are available for Slackware 14.2 and -current to fix security issues.

Slackware Security Advisory - New libarchive packages are available for Slackware 14.1, 14.2, and -current to fix security issues.

Slackware Security Advisory - New proftpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

Qualys discovered a vulnerability in OpenSMTPD, OpenBSD's mail server. This vulnerability is exploitable since May 2018 (commit a8e222352f, "switch smtpd to new grammar") and allows an attacker to execute arbitrary shell commands, as root.

Qualys discovered a minor vulnerability in OpenSMTPD, OpenBSD's mail server. An unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem). A proof of concept exploit is included in this archive.

PHPDirector version 0.30 suffers from an insecure cookie handling vulnerability that allows for privilege escalation.

The Plantronics Hub client application for Windows makes use of an automatic update service SpokesUpdateService.exe which automatically executes a file specified in the MajorUpgrade.config configuration file as SYSTEM. The configuration file is writable by all users by default. This module has been tested successfully on Plantronics Hub version 3.13.2 on Windows 7 SP1 (x64). This Metasploit module has been tested successfully on Plantronics Hub version 3.13.2 on Windows 7 SP1 (x64).

Maian Support Helpdesk version 4.3 suffers from a cross site request forgery vulnerability.

This Metasploit module exploits an arbitrary command execution flaw in the in.lpd service shipped with all versions of Irix.

A bug exists in the PalmOS httpd that causes a crash with a "Fatal Error". Full exploit included.

Xcon 2005: Hacking Windows CE

This Metasploit module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For targets before Windows Vista code execution can be achieved by first uploading the payload as an exe file, and then upload another mof file, which schedules WMI to execute the uploaded payload. This Metasploit module has been tested successfully on SolidWorks Workgroup PDM 2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell meta-characters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Qualys discovered a vulnerability in OpenSMTPD, OpenBSD's mail server. This vulnerability, an out-of-bounds read introduced in December 2015, is exploitable remotely and leads to the execution of arbitrary shell commands.

tcpdump allows you to dump the traffic on a network. It can be used to print out the headers and/or contents of packets on a network interface that matches a given expression. You can use this tool to track down network problems, to detect many attacks, or to monitor the network activities.

These are halcyon days for fleet-footed crossover SUVs. Saucy ‘utes like the 2020 Mercedes-Benz GLC 43 AMG hardly look like they’re just as quick as their smaller siblings but stopwatches don’t lie. In the example above, Mercedes says the GLC43 crossover takes just 4.7 seconds from 0-60 mph compared to the C43 sedan’s time...

Update: On March 2, 2017, U.S. Senators confirmed Rick Perry as the new Secretary of Energy of the United States. The vote was 62-37 with nine democratic senators casting "yes" votes. 

News related to the worldwide marine hydrokinetics industry from November-December 2014

News related to the marine hydrokinetics industry in North America for December 2014

Research reports and study findings related to hydropower

Once again flexing its investment muscles in renewable energy, Google is expanding its future purchasing plans for wind energy in Finland and taking a stake in another a Texas wind farm. Oh, and it also bought some home energy automation startup called Nest Labs.

UPDATE: The U.K. government yesterday launched its Domestic Renewable Heat Incentive (d-RHI), which pays households that generate heat and hot water using renewable energy systems such as solar hot water, geothermal heat pumps and biomass heating.