CLSA-2023-1677791921 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

CLSA-2023-1677784249 Fix CVE(s): CVE-2022-48303, CVE-2021-20193

SECURITY UPDATE: memory leak in readheader - debian/patches/CVE-2021-20193.patch: Don't return directly from the loop. Instead set the status and break. Return the status. - CVE-2021-20193.patch SECURITY UPDATE: a heap buffer overflow - debian/patches/CVE-2022-48303.patch: Check for the end of...

CLSA-2023-1677783967 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

CLSA-2023-1677783889 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

CLSA-2023-1677783720 tar: Fix of CVE-2022-48303

CVE-2022-48303: check for the end of field after leading byte 0x80 or 0xff of base-256 encoded header value...

Mitsubishi Electric MELSEC iQ-F Series

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric --------- Begin Update A Part 1 of 4 --------- Equipment: MELSEC iQ-F, iQ-R, Q, and L series --------- Begin Update A Part 1 of 4 --------- Vulnerability: Plaintext Storage of...

GHSA-F6HC-9G49-XMX7 nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this. From the fix commit notes: Unlike the rest of nistec, the P-256 assembly doesn't use complete addition formulas, meaning that...

nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this. From the fix commit notes: Unlike the rest of nistec, the P-256 assembly doesn't use complete addition formulas, meaning that...

nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this. From the fix commit notes: Unlike the rest of nistec, the P-256 assembly does not use complete addition formulas, meaning that...

GO-2023-1595 Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistec

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this...

LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems. The company said one of its DevOps engineers had their personal home compute...

Denial Of Service (DoS)

firefox is vulnerable to Denial Of Service DoS. The vulnerability exists when importing an SPKI RSA public key as ECDSA P-256. The key would be handled incorrectly, causing the tab to crash...

go -- crypto/elliptic: incorrect P-256 ScalarMult and ScalarBaseMult results

The Go project reports: crypto/elliptic: incorrect P-256 ScalarMult and ScalarBaseMult results The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve...

SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:0469-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0469-1 advisory. Updated to version 102.8.0 ESR bsc1208144: - CVE-2023-25728: Fixed content security policy leak in violation reports using iframes....

K15427: OpenSSL vulnerability CVE-2011-4354

Security Advisory Description crypto/bn/bnnist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST...

K73202036: Configuring SSL Forward Proxy and an OCSP stapling profile may allow a connection to a website with a revoked certificate

Security Advisory Description When you have configured the BIG-IP system for SSL Forward Proxy and have also configured an Online Certificate Status Protocol OCSP stapling profile, under certain conditions, the client could connect to a website with a revoked certificate without knowing it, despi...

K32743437: OpenSSL vulnerability CVE-2016-7056

Security Advisory Description A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. CVE-2016-7056 Impact A malicious user with local access can recover Elliptic Curve Digital Signature Algorithm ECDSA...

SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2023:0461-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0461-1 advisory. Updated to version 102.8.0 ESR bsc1208144: - CVE-2023-25728: Fixed content security policy leak ...

MGASA-2023-0056 Updated firefox packages fix security vulnerability

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled CVE-2023-0767. The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when...

Mozilla: Web Crypto ImportKey crashes tab

The Mozilla Foundation Security Advisory describes this flaw as: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash...