Hello:

Background
My ISP has been screwing around with the cabling and as a result of whatever they are up to I am (for maybe 72 hrs.?) without web access.

As a result (firmware update?) I have lost access to the ADSL modem's admin -> advanced options settings where I direct it to a Chimaera VM running a PiHole/Unbound recursive DNS in my main box.

The local telco is on a holy war to rip out all the copper lines and get everyone and their dog on fibre manu military and what is happening is part of the pressure on the clients to go along.

Fibre is something I do not want or need as if/when power goes down, there is nowhere to call as the fibre modem goes dead without power.
And without power, there's nothing to charge your phone's battery with after a day or so.

Till this problem gets solved, I am using a slow WiFi on my Asus 1000HE, enabled for me by a neighbour two doors down.
Should the admin lock-out turn out to be permanent, I'll post a question to solve the modem problem on another thread.

Request
For now I need the forum's collective to give me a hand and suggest a viable 32-bit browser for my 1000HE.
The installed browser (have not used it since before the pandemic) is Firefox 78.15.0esr, not the best choice at present.

As we know, Pale Moon stopped the 32-bit versions back in 2020.
The 1000HE is running Devuan 32-bit on a back ported kernel, just like my main box.

~$ uname -a
Linux eee-dev3 5.10.0-0.bpo.15-686-pae #1 SMP Debian 5.10.120-1~bpo10+1 (2022-06-13) i686 GNU/Linux
~$ 

Thanks in advance.

Best,

A.

Hello:

Good to know someone took over at X.Org.
Kudos to Kanapickas!  8^)

Just received this in my mbox:

---

X.Org Security Advisory: July 12, 2022

Multiple input validation failures in X server extensions
=========================================================

All theses issues can lead to local privileges elevation on systems
where the X server is running privileged and remote code execution for
ssh X forwarding sessions.

* CVE-2022-2319/ZDI-CAN-16062: X.Org Server ProcXkbSetGeometry Out-Of-Bounds
Access

The handler for the ProcXkbSetGeometry request of the Xkb extension does
not properly validate the request length leading to out of bounds memory
write.

* CVE-2022-2320/ZDI-CAN-16070: X.Org Server ProcXkbSetDeviceInfo Out-Of-Bounds
Access

The handler for the ProcXkbSetDeviceInfo request of the Xkb extension
does not properly validate the request length leading to out of bounds
memory write.

Patches
-------

Patches for this issues have been committed to the xorg server git
repository. xorg-server 21.1.4 will be released shortly and will
include these patches.

commit 6907b6ea2b4ce949cb07271f5b678d5966d9df42

     xkb: add request length validation for XkbSetGeometry
     
     No validation of the various fields on that report were done, so a
     malicious client could send a short request that claims it had N
     sections, or rows, or keys, and the server would process the request
     for N sections, running out of bounds of the actual request data.
     
     Fix this by adding size checks to ensure our data is valid.
     
     Fixes ZDI-CAN 16062, CVE-2022-2319.
     
     This vulnerability was discovered by:
     Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

commit dd8caf39e9e15d8f302e54045dd08d8ebf1025dc

     xkb: swap XkbSetDeviceInfo and XkbSetDeviceInfoCheck
     
     XKB often uses a FooCheck and Foo function pair, the former is
     supposed to check all values in the request and error out on
     BadLength, BadValue, etc. The latter is then called once we're
     confident the values are good (they may still fail on an individual
     device, but that's a different topic).
     
     In the case of XkbSetDeviceInfo, those functions were incorrectly
     named, with XkbSetDeviceInfo ending up as the checker function and
     XkbSetDeviceInfoCheck as the setter function. As a result, the setter
     function was called before the checker function, accessing request
     data and modifying device state before we ensured that the data is
     valid.
     
     In particular, the setter function relied on values being already
     byte-swapped. This in turn could lead to potential OOB memory access.
     
     Fix this by correctly naming the functions and moving the length checks
     over to the checker function. These were added in 87c64fc5b0 to the
     wrong function, probably due to the incorrect naming.
     
     Fixes ZDI-CAN 16070, CVE-2022-2320.
     
     This vulnerability was discovered by:
     Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
     
     Introduced in c06e27b2f6fd9f7b9f827623a48876a225264132

Backporting of the security fixes also needs this commit:
f1070c01d616c5f21f939d5ebc533738779451ac.

Thanks
======

The vulnerabilities have been discovered by Jan-Niklas Sohn working with
Trend Micro Zero Day Initiative and fixed by Peter Hutterer.

--
Povilas Kanapickas

-----

Best,

O.

Hello:

Found this early today.

---
Symbiote Linux malware spotted, and infections are 'very hard to detect'
'Performing live forensics on an infected machine may not turn anything up' warn researchers
---

https://forums.theregister.com/forum/al … x_malware/

Anyone know about this?

Best,

A.

Hello:

Saw this early today:

See:
https://www.theregister.com/2022/05/25/ … x_appears/

And:
https://lock.cmpxchg8b.com/linux123.html

I used it everyday many years ago at work, till DOS got killed and W3.10 was installed on the few available PCs.

Maybe it is finally gettings it's dues?   8^D!

A.