Design/Logic Flaw

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

UBUNTU-CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

CVE-2019-16910

Arm Mbed TLS prior to 2.19.0 and Arm Mbed Crypto prior to 2.0.0 are affected by CVE-2019-16910. When deterministic ECDSA is enabled, the RNG blinding uses insufficient entropy, enabling a side-channel based attack that could recover a private key if the same message is signed repeatedly. The issu...

CVE-2019-16910

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. For Mbed TLS, the fix...

Security Bulletin: IBM Security Privileged Identity Manager has released a fixpack in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following a fixpack for IBM Security Privileged Identity Manager in response to CVE-2017-5753 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 DESCRIPTION: Intel Haswell Xeon, AMD PRO and ARM Cortex A57 CPUs could allow a local authenticated attacker to...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-requests (EulerOS-SA-2019-1947)

According to the version of the python-requests package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 30...

EulerOS Virtualization for ARM 64 3.0.2.0 : cronie (EulerOS-SA-2019-1933)

According to the versions of the cronie packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service memory consumption via...

EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2019-1924)

According to the version of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4...

EulerOS Virtualization for ARM 64 3.0.2.0 : expat (EulerOS-SA-2019-1935)

According to the versions of the expat packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X...

EulerOS Virtualization for ARM 64 3.0.2.0 : zip (EulerOS-SA-2019-1925)

According to the version of the zip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - DISPUTED Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-urllib3 (EulerOS-SA-2019-1936)

According to the version of the python-urllib3 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect...

EulerOS Virtualization for ARM 64 3.0.2.0 : c-ares (EulerOS-SA-2019-1950)

According to the versions of the c-ares package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in c-ares. A hostname with an escaped trailing dot such as 'hello.' would have its size...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxslt (EulerOS-SA-2019-1929)

According to the versions of the libxslt packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an...

EulerOS Virtualization for ARM 64 3.0.2.0 : libX11 (EulerOS-SA-2019-1948)

According to the versions of the libX11 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions and...

EulerOS Virtualization for ARM 64 3.0.2.0 : libseccomp (EulerOS-SA-2019-1956)

According to the version of the libseccomp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators...

EulerOS Virtualization for ARM 64 3.0.2.0 : libpng (EulerOS-SA-2019-1951)

According to the versions of the libpng package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, a...

EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2019-1940)

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Binutils is a collection of binary utilities, including ar for creating, modifying and extracting from archives, as a...

EulerOS Virtualization for ARM 64 3.0.2.0 : git (EulerOS-SA-2019-1930)

According to the version of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service memory...