When a young Eva Kollisch arrives as a refugee in New York in 1940, she finds a community among socialists who share her values and idealism. She soon discovers ‘the cause’ isn’t as idyllic as it seems. Little does she know this is the beginning of a lifelong commitment to activism and her determination to create radical change in ways that include belonging, love and one's full self. In addition to Eva Kollisch’s memoirs Girl in Movement (2000) and The Ground Under My Feet (2014), LBI’s collections include an oral history interview with Eva conducted in 2014 and the papers of Eva’s mother, poet Margarete Kolllisch, which document Eva’s childhood experience on the Kindertransport. Learn more at www.lbi.org/kollisch . Exile is a production of the Leo Baeck Institute , New York | Berlin and Antica Productions . It’s narrated by Mandy Patinkin. Executive Producers include Katrina Onstad, Stuart Coxe, and Bernie Blum. Senior Producer is Debbie Pacheco. Associate Producers are Hailey Choi and Emily Morantz. Research and translation by Isabella Kempf. Sound design and audio mix by Philip Wilson, with help from Cameron McIver. Theme music by Oliver Wickham. Voice acting by Natalia Bushnik. Special thanks to the Kollisch family for the use of Eva’s two memoirs, “Girl in Movement” and “The Ground Under My Feet”, the Sophia Smith Collection at Smith College and their “Voices of Feminism Oral History Project”, and Soundtrack New York.…
Player FM - Internet Radio Done Right
Checked 13d ago
eighteen 周前已添加！
内容由Kevin Kaminski提供。所有播客内容（包括剧集、图形和播客描述）均由 Kevin Kaminski 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
Player FM -播客应用
使用Player FM应用程序离线！
使用Player FM应用程序离线！
))
值得一听的播客
赞助
PortalFuse Weekly Security Update Report (Windows and Edge Edition) – January 14, 2025
Manage episode 461291140 series 3611991
内容由Kevin Kaminski提供。所有播客内容（包括剧集、图形和播客描述）均由 Kevin Kaminski 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
The January 2025 security updates address several critical vulnerabilities, categorized as follows:
Elevation of Privilege Vulnerabilities:
- CVE-2025-21378 (Windows CSC Service): Heap-based buffer overflow granting SYSTEM privileges.
- CVE-2025-21335 (Windows Hyper-V NT Kernel): Use-after-free condition affecting Hyper-V integration, compromising guest and host environments.
- CVE-2025-21265 & CVE-2025-21310 (Windows Digital Media): Vulnerabilities triggered by physical access and malicious USB drives, escalating privileges.
- CVE-2025-21275 (Windows App Package Installer): Allows bypassing restrictions to gain elevated privileges.
Other vulnerabilities include issues in the Microsoft Brokering File System and Windows Virtualization-Based Security.
Remote Code Execution (RCE) Vulnerabilities:
- CVE-2025-21298 (Windows OLE): Exploitable through crafted emails or documents to run arbitrary code.
- CVE-2025-21296 (BranchCache): Malicious code execution in local network setups.
- CVE-2025-21291 (Windows Direct Show): Exploits malformed media files to trigger RCE.
- CVE-2025-21289 (Windows Shell): Allows code execution through malicious scripts.
Additional RCE vulnerabilities could lead to significant damage if left unpatched.
Information Disclosure Vulnerabilities:
- CVE-2025-21319 (Windows Kernel Memory): Exposes sensitive memory details in logs.
- CVE-2025-21288 (Windows COM Server): Uninitialized COM resources leak heap memory.
- CVE-2025-21210 & CVE-2025-21214 (Windows BitLocker): Risk of exposing encryption keys through physical access or side-channel attacks.
Security Feature Bypass Vulnerabilities:
- CVE-2025-21299 (Windows Kerberos): Bypasses Windows Defender Credential Guard, gaining access to Kerberos tickets.
- CVE-2025-21340 (Windows Virtualization-Based Security): Bypasses hypervisor isolation.
- CVE-2025-21215 & CVE-2024-7344 (Secure Boot): Exploits in the boot process allowing attackers to tamper with security checks.
Denial of Service (DoS) Vulnerabilities:
- CVE-2025-21284 & CVE-2025-21280 (Windows Virtual TPM): Causes system crashes by exploiting the Virtual TPM.
- CVE-2025-21274 (Windows Event Tracing): Crashes logging services, allowing undetected attacks.
- CVE-2025-21207 (Windows Connected Devices Platform Service): Disables network-based device management, causing downtime.
Join us as we discuss the latest CVEs, how they affect you and how to stay protected!
19集单集
分享Manage episode 461291140 series 3611991
内容由Kevin Kaminski提供。所有播客内容（包括剧集、图形和播客描述）均由 Kevin Kaminski 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。
The January 2025 security updates address several critical vulnerabilities, categorized as follows:
Elevation of Privilege Vulnerabilities:
- CVE-2025-21378 (Windows CSC Service): Heap-based buffer overflow granting SYSTEM privileges.
- CVE-2025-21335 (Windows Hyper-V NT Kernel): Use-after-free condition affecting Hyper-V integration, compromising guest and host environments.
- CVE-2025-21265 & CVE-2025-21310 (Windows Digital Media): Vulnerabilities triggered by physical access and malicious USB drives, escalating privileges.
- CVE-2025-21275 (Windows App Package Installer): Allows bypassing restrictions to gain elevated privileges.
Other vulnerabilities include issues in the Microsoft Brokering File System and Windows Virtualization-Based Security.
Remote Code Execution (RCE) Vulnerabilities:
- CVE-2025-21298 (Windows OLE): Exploitable through crafted emails or documents to run arbitrary code.
- CVE-2025-21296 (BranchCache): Malicious code execution in local network setups.
- CVE-2025-21291 (Windows Direct Show): Exploits malformed media files to trigger RCE.
- CVE-2025-21289 (Windows Shell): Allows code execution through malicious scripts.
Additional RCE vulnerabilities could lead to significant damage if left unpatched.
Information Disclosure Vulnerabilities:
- CVE-2025-21319 (Windows Kernel Memory): Exposes sensitive memory details in logs.
- CVE-2025-21288 (Windows COM Server): Uninitialized COM resources leak heap memory.
- CVE-2025-21210 & CVE-2025-21214 (Windows BitLocker): Risk of exposing encryption keys through physical access or side-channel attacks.
Security Feature Bypass Vulnerabilities:
- CVE-2025-21299 (Windows Kerberos): Bypasses Windows Defender Credential Guard, gaining access to Kerberos tickets.
- CVE-2025-21340 (Windows Virtualization-Based Security): Bypasses hypervisor isolation.
- CVE-2025-21215 & CVE-2024-7344 (Secure Boot): Exploits in the boot process allowing attackers to tamper with security checks.
Denial of Service (DoS) Vulnerabilities:
- CVE-2025-21284 & CVE-2025-21280 (Windows Virtual TPM): Causes system crashes by exploiting the Virtual TPM.
- CVE-2025-21274 (Windows Event Tracing): Crashes logging services, allowing undetected attacks.
- CVE-2025-21207 (Windows Connected Devices Platform Service): Disables network-based device management, causing downtime.
Join us as we discuss the latest CVEs, how they affect you and how to stay protected!
19集单集
All episodes
×
Welcome to this week’s episode of the PortalFuse Deep Dive, where we’re diving into a game-changer for Windows updates: Windows Hotpatching! 🎉 👉 Tired of Reboots? We’ve got the solution! Microsoft’s Hotpatching lets you install critical security updates without restarting your system! No more downtime, no more interruptions—just smooth, seamless patching! 💡💻 🔎 What’s in this episode? ✅ How Hotpatching works (magic? Almost! 🪄) ✅ Why it’s a big deal for IT admins & enterprises 🏢🔧 ✅ How it saves time, improves security, and boosts uptime 🚀 🌟 The Future of Windows Updates is Here! 🌟 We explore how Hotpatching is shaping the future of Windows 11 management and speculate what’s next for Windows servicing! 🎧 Tune in now and stay ahead of the curve in IT! Let’s talk tech without the reboot headache! 😎⚡ #Windows11 #Hotpatch #Intune #WUfB 🎤🎬…
In this episode of the PortalFuse Security Podcast, we dive into the latest security developments from our February 18, 2025, Weekly Security Report 📰. Stay ahead of the curve as we break down the most critical threats, vulnerabilities, and security updates affecting Windows, Microsoft Edge, and enterprise environments 🏢💻. 🔎 Key Topics This Week: 🚨 Windows Kernel Vulnerabilities – How newly discovered flaws could be exploited and what you can do to stay protected. 🛡️ Zero-Day Exploits in Edge Chromium – Attackers are actively targeting this browser—find out how to safeguard your organization. ⚙️ Microsoft’s Latest Security Patches – A deep dive into the latest updates and how they mitigate recent threats. 🚀 Emerging Cyber Threats & Attack Trends – Understanding the evolving tactics of cybercriminals and how to counter them. We’ll also share real-world insights 🌍 on how these vulnerabilities impact businesses and provide actionable security recommendations 🔑 to help IT professionals, security teams, and organizations strengthen their defenses 🏰. Whether you're an IT admin, a security analyst, or just passionate about cybersecurity, this episode is packed with critical information to keep you one step ahead of cyber threats! 🏆 🎧 Tune in now and stay secure! 🔗💙…
In this episode of the PortalFuse Security Podcast, we break down Microsoft’s February 2025 Patch Tuesday updates, covering the most critical vulnerabilities, security patches, and their impact on organizations and end-users. 🛠 Key Topics We Cover: ✔ The most severe vulnerabilities addressed in this month’s updates ✔ Zero-day threats and actively exploited flaws you need to patch ASAP ✔ Insights into Microsoft Defender, Windows, Edge, and enterprise security updates ✔ How these updates impact enterprise IT, security admins, and MSPs ✔ Best practices for rolling out patches without disrupting operations Join us as we analyze what’s fixed, what’s at risk, and what actions you should take now to keep your systems secure. Whether you’re an IT pro, security enthusiast, or just keen to stay ahead of the latest threats, this episode is packed with valuable insights to keep your environment protected. 🔔 Subscribe now to stay updated on the latest security trends and Microsoft patch releases! #PortalFuse #PatchTuesday #Cybersecurity #MicrosoftUpdates #SecurityPodcast…
In this episode, we dive into the fascinating evolution of software management—tracing the journey from the pioneering Linux package managers to Microsoft's modern Windows Winget. Join us as we explore how tools like APT, YUM, and Pacman revolutionized software installation and dependency management on Linux, and how those innovations paved the way for a more streamlined, secure, and automated experience on Windows. We'll discuss: The Origins: How Linux package managers emerged to solve real-world challenges in managing complex software ecosystems. Key Benefits: The security, efficiency, and ease of updates that made package managers indispensable. Cross-Platform Influence: How the success of Linux solutions inspired native package management tools on other operating systems, culminating in the arrival of Windows Winget. The Future: Predictions and insights into how package management might evolve further with cross-platform integration, containerization, and enhanced user interfaces. Whether you’re a Linux aficionado, a Windows enthusiast, or just curious about how these systems work behind the scenes, this episode offers insights and engaging discussions about the past, present, and future of software distribution. Tune in to understand how a command-line revolution is reshaping the way we install and maintain our software—and what that means for the future of computing. Subscribe now on YouTube and join the conversation! From Linux Package Managers to Windows Winget: The Evolution of Software Distribution | CheckYourLogs.Net…
In this episode, we dive into a blog article written by one of our founders Kevin Kaminski, The Evolving Windows Application Deployment Landscape: Embracing the MSIX Era , and explore how MSIX is transforming Windows application management. Join us as we review the key insights from the article—from how MSIX simplifies installations and updates, to its robust security features and seamless integration with modern management tools like Microsoft Endpoint Manager. We also discuss the flexibility it offers for both legacy Win32 applications and modern software, including its role in Windows S Mode environments. Tune in as we break down: The benefits of a modular, efficient deployment process. The impact of differential updates and enhanced security. Real-world implications for IT professionals and developers. Whether you're a seasoned IT pro or just curious about the future of Windows deployment, this episode offers valuable insights to help you navigate the evolving landscape of application packaging. The Evolving Windows Application Deployment Landscape: Embracing the MSIX Era | CheckYourLogs.Net…
Check it out, a special episode from Checkyourlogs.net where we unravel the complexities of upgrading to Windows 11 with a proactive roadmap designed to ensure a seamless transition. In this episode, we sit down with seasoned experts—including insights inspired by our heritage at PortalFuse Inc.—to explore key strategies, best practices, and actionable steps that empower IT teams to embrace the new operating system with confidence. Whether you're just beginning your upgrade journey or already deep in transition, this discussion offers the clarity and direction you need to navigate today’s dynamic digital landscape. Tune in to learn how to mitigate risks, anticipate challenges, and leverage Windows 11's enhanced security and performance for a future-ready IT infrastructure. Upgrading to Windows 11: A Proactive Roadmap for a Smooth Transition | CheckYourLogs.Net…
Podcast Title: PortalFuse Security Update – Chromium Vulnerability, Windows 11 Enhancements & Windows 10 Upgrade Fix In this week’s PortalFuse Security Update podcast, we dive into the critical security developments that every IT administrator and cybersecurity professional needs to know. We start with an in-depth look at the newly patched Chromium use-after-free vulnerability (CVE-2025-0762) in Microsoft Edge’s DevTools—a flaw that could have allowed attackers to execute arbitrary code if left unpatched. Learn how updating to Edge version 132.0.2957.140 can protect your enterprise systems from potential exploits. Next, we explore the latest Windows 11 update (KB5050092) released on January 29, 2025. Discover the key enhancements that improve your desktop experience—from refined taskbar previews and smoother animations to better file sharing and virtual memory management. We also cover the performance boosts in Task Manager, Remote Desktop, and USB device compatibility, alongside fixes that enhance the reliability of NFC readers and printers. Finally, we address a common hurdle faced by Windows 10 users: the Upgrade Assistant getting stuck at 99%. Our episode provides a clear, step-by-step workaround to get your upgrade back on track, ensuring that your system continues to receive the latest updates without disruption. Tune in for essential security insights, actionable troubleshooting tips, and a comprehensive overview of the latest system enhancements to keep your IT environment secure and efficient. Stay informed, stay secure, and join us for a deep dive into modern IT management best practices. Listen now on your favorite podcast platform and stay ahead of the curve with PortalFuse Security Update!…
PortalFuse Weekly Security Report Podcast – January 2025 Updates In this week's episode, we break down the most critical security updates for Microsoft Edge, Windows 10, and Windows 11. Key highlights include: 🔹 Microsoft Edge Vulnerabilities: Urgent updates required for CVE-2025-21262, CVE-2025-0612, and CVE-2025-0611, which could allow UI spoofing and arbitrary code execution. 🔹 Windows 10 & 11 Fixes: Latest KB5050081 and KB5050758 updates bring improvements, including Snipping Tool crash fixes, USB device compatibility updates, and Windows Kernel security enhancements to block vulnerable drivers. 🔹 Known Issues & Workarounds: Troubleshooting OpenSSH service failures, Windows Event Viewer errors, and Citrix update conflicts to help IT teams mitigate disruptions. 🔹 Final Security Recommendations: The latest patching insights and best practices to keep your systems secure and reduce the risk of exploitation. Stay ahead of the latest cybersecurity threats—tune in now!…
In this week’s PortalFuse Weekly Security Report, we delve into two high-severity vulnerabilities shaking up the cybersecurity landscape. First, we examine CVE-2025-21325, a critical flaw in Windows Secure Kernel Mode that allows an attacker to escalate privileges by manipulating page table data. We’ll unpack how this vulnerability leads to complete loss of confidentiality, integrity, and availability, and why immediate patching on Windows 10, Windows 11, and Windows Server 2025 systems is essential. Next, we explore recent security holes in Microsoft Edge stemming from its reliance on the Chromium engine. Notably, CVE-2025-21185 can grant unauthorized access to sensitive information via crafted URLs. We’ll also break down the technical details of related Chromium vulnerabilities, from out-of-bounds memory access in the V8 engine to insufficient data validation in Extensions. Join us as we provide expert guidance on mitigating these threats, including the latest Microsoft KB updates and Edge version 132.0.2957.115. We’ll share best practices for patch management, browser security policies, and proactive monitoring to keep your organization safe in an evolving threat environment. Tune in and stay informed with PortalFuse Weekly Security Report!…
The January 2025 security updates address several critical vulnerabilities, categorized as follows: Elevation of Privilege Vulnerabilities: CVE-2025-21378 (Windows CSC Service): Heap-based buffer overflow granting SYSTEM privileges. CVE-2025-21335 (Windows Hyper-V NT Kernel): Use-after-free condition affecting Hyper-V integration, compromising guest and host environments. CVE-2025-21265 & CVE-2025-21310 (Windows Digital Media): Vulnerabilities triggered by physical access and malicious USB drives, escalating privileges. CVE-2025-21275 (Windows App Package Installer): Allows bypassing restrictions to gain elevated privileges. Other vulnerabilities include issues in the Microsoft Brokering File System and Windows Virtualization-Based Security. Remote Code Execution (RCE) Vulnerabilities: CVE-2025-21298 (Windows OLE): Exploitable through crafted emails or documents to run arbitrary code. CVE-2025-21296 (BranchCache): Malicious code execution in local network setups. CVE-2025-21291 (Windows Direct Show): Exploits malformed media files to trigger RCE. CVE-2025-21289 (Windows Shell): Allows code execution through malicious scripts. Additional RCE vulnerabilities could lead to significant damage if left unpatched. Information Disclosure Vulnerabilities: CVE-2025-21319 (Windows Kernel Memory): Exposes sensitive memory details in logs. CVE-2025-21288 (Windows COM Server): Uninitialized COM resources leak heap memory. CVE-2025-21210 & CVE-2025-21214 (Windows BitLocker): Risk of exposing encryption keys through physical access or side-channel attacks. Security Feature Bypass Vulnerabilities: CVE-2025-21299 (Windows Kerberos): Bypasses Windows Defender Credential Guard, gaining access to Kerberos tickets. CVE-2025-21340 (Windows Virtualization-Based Security): Bypasses hypervisor isolation. CVE-2025-21215 & CVE-2024-7344 (Secure Boot): Exploits in the boot process allowing attackers to tamper with security checks. Denial of Service (DoS) Vulnerabilities: CVE-2025-21284 & CVE-2025-21280 (Windows Virtual TPM): Causes system crashes by exploiting the Virtual TPM. CVE-2025-21274 (Windows Event Tracing): Crashes logging services, allowing undetected attacks. CVE-2025-21207 (Windows Connected Devices Platform Service): Disables network-based device management, causing downtime. Join us as we discuss the latest CVEs, how they affect you and how to stay protected!…
As the holiday season approaches we managed to break the reports after adding some additional functionality to our AI model. A week late we bring you the final PortalFuse Weekly Security Update of 2024 as no CVEs were detected for this week. This week’s report focuses on critical vulnerabilities affecting Microsoft Edge, derived from the Chromium Open Source Software (OSS). Let us dive into the details and ensure your systems are secure during this festive period. Overview of This Week’s CVEs CVE-2024-12695: Out of Bounds Write in V8 Impact: This critical vulnerability in the V8 JavaScript engine affects Microsoft Edge (Chromium-based). Details: The vulnerability allows an out-of-bounds write, potentially enabling attackers to execute arbitrary code in the context of the current user. The root cause lies in Chromium’s memory handling. Fix: Addressed in Microsoft Edge version 131.0.2903.112, released on December 19, 2024. Recommendation: System administrators should update to this version immediately to mitigate the risk. Additional Information: Refer to Google Chrome Releases for more details. CVE-2024-12694: Use After Free in Compositing Impact: A critical vulnerability in the Compositing feature of Microsoft Edge (Chromium-based). Details: This vulnerability could be exploited by attackers to execute arbitrary code, potentially leading to unauthorized access or data manipulation. Fix: Addressed in Microsoft Edge version 131.0.2903.112. Recommendation: Update your Microsoft Edge installations promptly. Additional Information: Refer to Google Chrome Releases . CVE-2024-12693: Out of Bounds Memory Access in V8 Impact: A critical vulnerability due to out-of-bounds memory access in the V8 engine. Details: This issue could allow attackers to execute arbitrary code. It originates from Chromium’s codebase utilized by Microsoft Edge. Fix: Resolved in Microsoft Edge version 131.0.2903.112. Recommendation: Ensure your systems are updated to the latest version. Additional Information: See Google Chrome Releases . CVE-2024-12692: Type Confusion in V8 Impact: A critical vulnerability in the V8 JavaScript engine, stemming from type confusion issues. Details: Exploitation could allow arbitrary code execution, with significant security implications. Fix: Fixed in Microsoft Edge version 131.0.2903.112. Recommendation: Apply the update immediately to secure your environment. Additional Information: Consult Google Chrome Releases . This week’s report highlights four critical vulnerabilities affecting Microsoft Edge, all stemming from Chromium’s codebase. The vulnerabilities include memory handling issues such as out-of-bounds writes, use-after-free conditions, and type confusion, all of which could lead to arbitrary code execution. These issues were promptly addressed with updates to Microsoft Edge version 131.0.2903.112. While serious, they are standard for high-impact CVEs and demonstrate the ongoing need for vigilance in software maintenance. For more information, you can access the full report or listen to our audio podcast summarizing this week’s updates. Conclusion This week’s vulnerabilities emphasize the critical need for prompt action in applying updates and addressing software flaws to maintain a robust security posture. Microsoft Edge version 131.0.2903.112 addresses all the listed CVEs, making it essential to update immediately. Thank you for following our weekly updates throughout 2024. As we close the year, we wish you a Merry Christmas for your friends and family! Stay secure and enjoy the festivities.…
A quiet week so far for the holidays. Two critical security vulnerabilities affecting Microsoft Edge, stemming from the Chromium project, were addressed this week. Two critical security vulnerabilities affecting Microsoft Edge, stemming from the Chromium project, were addressed this week. These vulnerabilities underscore the importance of timely updates to ensure system security and user safety. With these fixes in place, users can mitigate significant risks posed by these flaws. CVE-2024-12382 Use After Free in Translate Vulnerability Description: This flaw affects the Translate feature in Microsoft Edge, which is built on Chromium OSS. An attacker exploiting this vulnerability could execute arbitrary code within the context of the current user. The issue arises from improper memory management. Resolution: Microsoft has addressed this vulnerability in Edge version 131.0.2903.99, released on December 12, 2024. The update aligns with Chromium’s fixes, ensuring system integrity. Action Required: System administrators should prioritize updating to this version of Microsoft Edge immediately. For further details, refer to the Microsoft Edge Security Release Notes . CVE-2024-12381 Type Confusion in V8 Vulnerability Description: This type confusion vulnerability in Chromium’s V8 JavaScript engine could enable an attacker to execute arbitrary code. As with CVE-2024-12382, this issue impacts Microsoft Edge due to its dependency on Chromium OSS. Resolution: The fix was incorporated in the same Edge release (version 131.0.2903.99) on December 12, 2024. Action Required: Ensure all systems using Microsoft Edge are updated to version 131.0.2903.99 to mitigate risks. Both vulnerabilities illustrate the interconnected nature of software ecosystems like Chromium-based browsers. Proactive updates are critical in minimizing exposure to such risks. We then turn to another significant development—the resolution of issues with WPF applications using IMEs. We also cover open issues with dual boot Linux systems and the WinApp SDK. Give us a few minutes of your time to get the latest updates for Edge.…
Welcome to "Addressing Critical CVEs: Enhancing System Security," your go-to podcast for the latest system vulnerabilities and security patch updates. In this episode, we delve into Microsoft's December 2024 updates, which tackle a range of critical vulnerabilities, from remote code execution to elevation of privilege and denial of service. Remote Code Execution: This week, we explore several Remote Code Execution (RCE) vulnerabilities that highlight the increasing sophistication of exploits targeting core system services. Notable patches include: CVE-2024-49132: A Windows Remote Desktop Services RCE vulnerability caused by a race condition, allowing attackers to execute arbitrary code remotely without user interaction. CVE-2024-49127: An LDAP RCE vulnerability that lets attackers execute code within SYSTEM context. CVE-2024-49122: An MSMQ RCE vulnerability enabling remote code execution via crafted MSMQ packets. Elevation of Privilege: We also discuss Elevation of Privilege (EoP) vulnerabilities, which are increasingly targeting local privilege escalation pathways. Key patches include: CVE-2024-49114: A Cloud Files Mini Filter Driver vulnerability allowing SYSTEM level privilege escalation. CVE-2024-49111: A WwanSvc vulnerability exploitable for sensitive resource access. CVE-2024-49088: A Windows Common Log File System Driver vulnerability enabling privilege escalation through buffer over-read flaws. Denial of Service: Closing out 2024, we address Denial of Service (DoS) vulnerabilities, particularly those exploiting directory-related services like LDAP. Critical patches include: CVE-2024-49121: An LDAP DoS vulnerability interrupting directory lookups and authentication. CVE-2024-49113: An out-of-bounds read vulnerability in LDAP causing resource exhaustion. CVE-2024-49126: A Windows Defender DoS vulnerability leading to resource exhaustion and system crashes. Key KB Articles: We transition to the Knowledge Base (KB) articles that provide crucial context for applying these fixes. Highlights include: KB5048703: Enhances security within the Windows 10 ecosystem. KB5048652: Focuses on improving stability for Windows 10 Version 22H2. KB5048794: Enhances performance and stability for Windows 11 enterprise environments. KB5048685: Applies to Windows 11 Enterprise and Education versions, addressing vulnerabilities in the OpenSSH subsystem and improving GPU-intensive task performance. Wrapping Up: As we transition into 2025, prioritizing regular patch management, vulnerability assessments, and staying informed about emerging threats will be crucial for ensuring robust IT infrastructure resilience. Thank you for tuning in to this Patch Tuesday report. Your dedication to securing systems is appreciated. Wishing you a secure and Merry Christmas from everyone at PortalFuse to you and your family!…
This week’s updates balance critical fixes with quality-of-life improvements. By staying informed and proactively addressing vulnerabilities, you’re not only securing your systems but also laying a foundation for smoother operations as the year ends. Let us know if this breakdown resonates with you or if you’d like deeper dives into specific topics. Stay secure and see you next week!…
This week’s report includes nine new CVEs related to Microsoft Edge, all of which have been addressed in the latest version (131.0.2903.48) released on November 19, 2024. The vulnerabilities range from inappropriate implementation issues to insufficient policy enforcement and arbitrary code execution. Additionally, several key known issues impacting Windows 10 and 11 are currently under investigation. Be sure to review the details below to understand their impact on your environment.…
欢迎使用Player FM
Player FM正在网上搜索高质量的播客，以便您现在享受。它是最好的播客应用程序，适用于安卓、iPhone和网络。注册以跨设备同步订阅。
Daily Deals
Player FM -播客应用
使用Player FM应用程序离线！
使用Player FM应用程序离线！
))
