hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

SUSE-SU-2019:2955-1 Security update for qemu

This update for qemu fixes the following issues: qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. CVE-2018-20126 bsc1119991, CVE-2019-14378 bsc1143794, and CVE-2019-15890 bsc1149811...

Microsoft Guidance for Vulnerability in Trusted Platform Module (TPM)

Executive Summary This advisory addresses CVE-2019-16863. A security vulnerability exists in certain Trusted Platform Module TPM chipsets. The vulnerability weakens key confidentiality protection for a specific algorithm ECDSA. It is important to note that this is a TPM firmware vulnerability, an...

RIPS 3.3: Scaling Security Testing to Large Teams

Data Center Edition Automated security testing with RIPS is typically performed when a new code feature is merged into the development branch. But when security scanning is shifted left to the developers who scan every single code commit, the total amount of scans increases significantly. As a...

Citrix Hypervisor Security Update

Description of Problem A security issue has been identified in certain CPU hardware that may allow unprivileged code running on a CPU core to infer the value of memory data belonging to other processes, virtual machines or the hypervisor that are, or have recently been, running on the same CPU...

CVE-2011-2336

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts...

Design/Logic Flaw

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts...

CVE-2011-2336

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts...

CVE-2011-2336

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that signal when a hardware animation starts...

CVE-2011-2336

The CVE-2011-2336 entry concerns WebKit in Google Chrome prior to Blink M12, involving a flaw in AnimationControllerPrivate when clearing lists that signal the start of a hardware animation. The affected surface is WebKit’s animation controller logic embedded in Chrome, with no explicit affected ...

QEMU: qxl: null pointer dereference while releasing spice resources

interfacereleaseresource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference...

Google Is Helping Design an Open Source, Ultra-Secure Chip

OpenTitan is a so-called secure enclave based on open source that could shake up hardware security...

Further enhancing security from Microsoft, not just for Microsoft

Legacy infrastructure. Bolted-on security solutions. Application sprawl. Multi-cloud environments. Company data stored across devices and apps. IT and security resource constraints. Uncertainty of where and when the next attack or leak will come, including from the inside. These are just a few of...

Archos Safe-T Information Disclosure Vulnerability

Archos Safe-T is a hardware-based cryptocurrency wallet device. An information disclosure vulnerability exists in Archos Safe-T, which arises from errors such as configuration during operation of a networked system or product, and can be exploited by an unauthorized attacker to gain access to...

CVE-2019-14358

On Archos Safe-T devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to...

CVE-2019-14360

On Hyundai Pay Kasse HK-1000 devices, there is a side-channel vulnerability in the row-based OLED display: power consumption per display cycle leaks information about the number of illuminated pixels. This can enable partial recovery of display contents, and could let an attacker with control ove...

CVE-2019-18673

CVE-2019-18673 affects SHIFT BitBox02 devices and describes a side-channel where the power draw of the row-based OLED display varies with the number of illuminated pixels. This enables partial recovery of display contents if an attacker has sufficient control over the device’s USB connection to m...

CVE-2019-18673

On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to...

CVE-2019-15098

A flaw was found in the Linux kernel's implementation of the ath6kl wireless network driver implementation, which could allow an attacker with physical access with custom USB hardware to plug into a rogue USB device that can create a condition where the kernel will panic. Mitigation No mitigation...

Buffer overflow

DISPUTED On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable...