cryptofuzz/cryptofuzz-boringssl-noasm: Unknown signal in Hacl_Hash_Core_SHA1_update

Detailed report: https://oss-fuzz.com/testcase?key=5734860108333056 Project: cryptofuzz Fuzzer: libFuzzercryptofuzzcryptofuzz-boringssl-noasm Fuzz target binary: cryptofuzz-boringssl-noasm Job Type: libfuzzerubsancryptofuzz Platform Id: linux Crash Type: Unknown signal Crash Address: 0x000000c285...

boringssl/read_pem: Use-of-uninitialized-value in PEM_read_bio

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=5632355033677824 Project: boringssl Fuzzer: libFuzzerboringsslreadpem Fuzz target binary: readpem Job Type: libfuzzermsanboringssl Platform Id: linux Crash Type: Use-of-uninitialized-value Cra...

boringssl/ssl_ctx_api: Use-of-uninitialized-value in parse_sigalgs_list

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=5714757638684672 Project: boringssl Fuzzer: libFuzzerboringsslsslctxapi Fuzz target binary: sslctxapi Job Type: libfuzzermsanboringssl Platform Id: linux Crash Type: Use-of-uninitialized-value...

Google Chrome BoringSSL Information Disclosure Vulnerability

Google Chrome is a web browser developed by Google, Inc. BoringSSL is a fork of the OpenSSL library used to implement encryption and TLS functionality in Google products. A security vulnerability exists in the SPAKE2 implementation of BoringSSL in versions of Google Chrome prior to 63.0.3239.84. ...

CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

Information disclosure

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

UBUNTU-CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

CVE-2017-15423

Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512password by inspecting protocol traffic...

CVE-2017-15423

CVE-2017-15423 affects Google Chrome’s BoringSSL SPAKE2 implementation prior to 63.0.3239.84, enabling a remote attacker to leak low-order bits of SHA512(password) by inspecting protocol traffic. The vulnerability is documented in CVE-2017-15423 and corroborated by CNVD-2018-20147 (Google Chrome ...

CVE-2017-15423

Removed by vendor...

boringssl/ssl_ctx_api: Heap-buffer-overflow in parse_sigalgs_list

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=5807097051611136 Project: boringssl Fuzzer: libFuzzerboringsslsslctxapi Fuzz target binary: sslctxapi Job Type: libfuzzerasanboringssl Platform Id: linux Crash Type: Heap-buffer-overflow READ ...

CVE-2018-12440

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host...

Memory corruption

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host...

CVE-2018-12440

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host...

CVE-2018-12440

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host...

CVE-2018-12440

BoringSSL (through 2018-06-14) is affected by a memory-cache side-channel vulnerability against DSA signatures, known as the Return Of the Hidden Number Problem (ROHNP). Attack prerequisites: local access or co-residency on the same physical host (local VM). The vulnerability description in conne...

CVE-2018-12440

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host...

BoringSSL ROHNP Vulnerability

BoringSSL is a branch library of OpenSSL used to implement encryption and TLS functionality in Google products. A security vulnerability exists in BoringSSL versions 2018-06-14 and earlier. An attacker can exploit the vulnerability to obtain a DSA key by accessing a local device or a different...

boringssl/client: Use-of-uninitialized-value in bn_sub_words

Project: https://boringssl.googlesource.com/boringssl Detailed report: https://oss-fuzz.com/testcase?key=4823691606097920 Project: boringssl Fuzzer: libFuzzerboringsslclient Fuzz target binary: client Job Type: libfuzzermsanboringssl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...