CVE-2019-1706

Summary: CVE-2019-1706 affects Cisco ASAv and Firepower 2100 Series running ASA software. The issue is a logic error in the software cryptography module’s handling of IPsec sessions, allowing an unauthenticated, remote attacker to trigger a device reload and a DoS condition by generating many IPs...

The vulnerability of the Go programming language’s crypto module, which allows a hacker to trigger a service failure

The vulnerability of the Go programming language’s crypto module exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Entropy Backdoor

Overview All versions of text-qrcode contain malicious code that overwrites the randomBytes method for the crypto module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte val...

PT-2019-1350

Name of the Vulnerable Software and Affected Versions Go versions prior to 1.10.8 Go versions 1.11.x prior to 1.11.5 Description The issue exists due to insufficient input validation in the crypto module of the Go programming language. This can be exploited by a remote attacker to cause a denial ...

CRYPTO module buffer overflow vulnerability in multiple Huawei products

Huawei DP300, RP200, TE30/40/50/60, TP3106/3206, and ViewPoint 9030 are Huawei's all-in-one Desktop Intelligence products and HD video conferencing terminals for high-end customers. A buffer overflow vulnerability exists in the CRYPTO module of multiple Huawei products, which is due to the progra...

Security Advisory - Two Vulnerabilities in CRYPTO module of Several Huawei Products

There is a buffer overflow vulnerability in the CRYPTO module of several Huawei products. An unauthenticated, local attacker could craft malformed file with a specific field that the length is longer than the maximum value. Due to insufficient validation of the inputs, successful exploit could...

Unbreakable Enterprise kernel security update

2.6.39-400.264.13 - KEYS: Don't permit requestkey to construct a new keyring David Howells Orabug: 22373449 CVE-2015-7872 2.6.39-400.264.12 - crypto: add missing crypto module aliases Mathias Krause Orabug: 22249656 CVE-2013-7421 CVE-2014-9644 - crypto: include crypto- module prefix in template...

USN-2545-1 linux-lts-utopic vulnerabilities

A flaw was discovered in the automatic loading of modules in the crypto subsystem of the Linux kernel. A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges. CVE-2013-7421 A flaw was...

USN-2514-1: Linux kernel (OMAP4) vulnerabilities

A flaw was discovered in the Kernel Virtual Machine's KVM emulation of the SYSTENTER instruction when the guest OS does not initialize the SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of service of the guest OS crash or potentially gain privileges on the guest OS...

nfs-utils security, bug fix, and enhancement update

1.2.3-15 - mout.nfs: Don't roll back to IPv4 whe IPv6 fails bz 744657 - rpcdebug: Added pNFS and FSCache debugging bz 747400 1.2.3-14 - mount.nfs: Backported how upstream handles the SIGXFSZ signal bz 697981 1.2.3-13 - mount.nfs: Reworked the code that deals with RLIMITFSIZE bz 697981 1.2.3-12 -...