VMware product updates address OpenSSL security vulnerabilities

a. Information Disclosure vulnerability in OpenSSL third party library The OpenSSL library is updated to version openssl-1.0.1g to resolve multiple security issuesThe Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2014-0076 and CVE-2014-0160 to these issues...

Mandriva Linux Security Advisory : openssl (MDVSA-2014:067)

Updated openssl packages fix security vulnerability : The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attac...

Security fix for the ALT Linux 7 package openssl10 version 1.0.1g-alt1

1.0.1g-alt1 built April 8, 2014 rootldv in task 117869 April 7, 2014 Dmitry V. Levin - Updated to 1.0.1g fixes CVE-2014-0076 and CVE-2014-0160...

Slackware 14.0 / 14.1 / current : openssl (SSA:2014-098-01)

New openssl packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-098-01. The text itself is copyright C...

GLSA-201404-07 : OpenSSL: Information Disclosure

The remote host is affected by the vulnerability described in GLSA-201404-07 OpenSSL: Information Disclosure Multiple vulnerabilities have been found in OpenSSL: OpenSSL incorrectly handles memory in the TLS heartbeat extension, leading to information disclosure of 64kb per request, possibly...

Ubuntu 12.04 LTS / 12.10 / 13.10 : openssl vulnerabilities (USN-2165-1)

Neel Mehta discovered that OpenSSL incorrectly handled memory in the TLS heartbeat extension. An attacker could use this issue to obtain up to 64k of memory contents from the client or server, possibly leading to the disclosure of private keys and other sensitive information. CVE-2014-0160 Yuval...

USN-2165-1: OpenSSL vulnerabilities

Neel Mehta discovered that OpenSSL incorrectly handled memory in the TLS heartbeat extension. An attacker could use this issue to obtain up to 64k of memory contents from the client or server, possibly leading to the disclosure of private keys and other sensitive information. CVE-2014-0160 Yuval...

Security fix for the ALT Linux 9 package openssl1.1 version 1.0.1g-alt1

April 7, 2014 Dmitry V. Levin 1.0.1g-alt1 - Updated to 1.0.1g fixes CVE-2014-0076 and CVE-2014-0160...

Security fix for the ALT Linux 8 package openssl10 version 1.0.1g-alt1

April 7, 2014 Dmitry V. Levin 1.0.1g-alt1 - Updated to 1.0.1g fixes CVE-2014-0076 and CVE-2014-0160...

Security fix for the ALT Linux 9 package openssl10 version 1.0.1g-alt1

April 7, 2014 Dmitry V. Levin 1.0.1g-alt1 - Updated to 1.0.1g fixes CVE-2014-0076 and CVE-2014-0160...

CVE-2014-0076

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack...

CVE-2014-0076

CVE-2014-0076 concerns the OpenSSL Montgomery ladder implementation. The issue is a timing/side-channel flaw in how certain swap operations are performed, enabling a local attacker to recover ECDSA nonces via a FLUSH+RELOAD cache side-channel. Affected product: OpenSSL up to 1.0.0l (and related O...

Vulnerability in OpenSSL CVE-2014-0076

Fix for the attack described in the paper “Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack”. Found by Yuval Yarom and Naomi Benger...

OABOARD Web Forum forum.php inc Parameter PHP Code Execution - Ver2 (CVE-2006-0076)

A code execution vulnerability has been reported in OABoard. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

OABOARD Web Forum forum.php inc Parameter PHP Code Execution - Ver2 (CVE-2006-0076)

A code execution vulnerability has been reported in OABoard. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Oracle Application Express (Apex) CVE-2010-0076

An unspecified vulnerability in version 3.2.1 of the Application Express Application Builder component of Oracle Database allows remote, authenticated users to affect confidentiality, integrity, and availability via unpublished vectors...

CVE-2013-0076

The CVE-2013-0076 entry refers to a local privilege-escalation vulnerability in the Client/Server Run-time Subsystem (CSRSS) on affected Windows versions. Specifically, CSRSS in Windows 7 (Gold/SP1) and Windows Server 2008 R2 (SP1) mishandles in-memory objects, enabling a local attacker to gain e...

Microsoft Windows Client/Server Run-time Subsystem Privilege Escalation Vulnerability (2790113)

This host is missing an important security update according to Microsoft Bulletin MS13-019. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS13-019: Vulnerability in Windows Client/Server Run-time Subsystem (CSRSS) Could Allow Elevation of Privilege (2790113)

The Windows Client/Server Run-time Subsystem CSRSS on the remote host has a privilege escalation vulnerability. Permissions are not properly validated when a lower-integrity process communicates a device event to a higher-integrity process. A local attacker could exploit this vulnerability to gai...

CVE-2012-0076

Technical details for CVE-2012-0076 are not publicly available in the provided documents. Monitor for updates as more information may be released.