9561 matches found
DLA-144-1 polarssl - security update
Bulletin has no description...
Linux Kernel Crypto API Local Security Bypass Vulnerability (CNVD-2015-00752)
Linux is an open source computer operating system kernel. A local security bypass vulnerability exists in the Linux Kernel Crypto API, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...
kernel security and bug fix update
2.6.32-504.8.1 - crypto crc32c: Kill pointless CRYPTOCRC32CX8664 option Jarod Wilson 1175509 1036212 - crypto testmgr: add larger crc32c test vector to test FPU path in crc32cintel Jarod Wilson 1175509 1036212 - crypto tcrypt: Added speed test in tcrypt for crc32c Jarod Wilson 1175509 1036212 -...
Linux Kernel Crypto API Local Security Bypass Vulnerability (CNVD-2015-00753)
Linux is an open source computer operating system kernel. A local security bypass vulnerability exists in the Linux Kernel Crypto API, which can be exploited by an attacker to bypass certain security restrictions and perform unauthorized operations...
Fedora 20 : kde-runtime-4.14.3-3.fc20 (2015-0564)
Pull in upstream fixes for: CVE-2013-7252 kwallet: crypto misuse, and kiosftp corruption Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
FBI Releases "Ransomware on the Rise"
The FBI has released an article addressing ransomware campaigns that use intimidating messages claiming to be from the FBI or other government agencies. Scam operators use ransomware – a type of malicious software – to infect a computer and restrict access to it until a ransom is paid to unlock i...
Matthew Green on the NSA and Compromising Crypto Standards
Dennis Fisher talks with Matthew Green of Johns Hopkins University about the NSA’s “regret” for continuing to support Dual EC after it had been shown to be compromised, the effects of the agency’s influence on crypto standards and the hope for more secure standards in the future. Download:...
Fedora 21 : kde-runtime-4.14.3-3.fc21 (2015-0569)
Pull in upstream fixes for: CVE-2013-7252 kwallet: crypto misuse, and kiosftp corruption Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
Peerio — End-to-End Encrypted Secure Messenger and File Sharing App
On one end, where governments of countries like U.K is criticizing end-to-end encryption and considering to ban the encrypted communication apps like Snapchat, CryptoCat, WhatsApp and Apple’s iMessage. On the other hand, the Internet community has come up with a new and rather more secure encrypt...
UBUNTU-CVE-2014-9644
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AFALG socket with a parenthesized module template expression in the salgname field, as demonstrated by the vfataes expression, a different vulnerability than...
CVE-2014-9644
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AFALG socket with a parenthesized module template expression in the salgname field, as demonstrated by the vfataes expression, a different vulnerability than...
NTP Project Network Time Protocol daemon (ntpd) contains multiple vulnerabilities (Updated)
Overview The NTP Project ntpd version 4.2.7 and pervious versions contain several vulnerabilities. ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys. These vulnerabilities may affect ntpd acting as a server or client...
Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20141216)
A flaw was found in the way the Linux kernel's SCTP implementation handled malformed or duplicate Address Configuration Change Chunks ASCONF. A remote attacker could use either of these flaws to crash the system. CVE-2014-3673, CVE-2014-3687, Important - A flaw was found in the way the Linux...
Google Releases End-To-End Chrome Extension to Open Source
Google yesterday announced that it has released the source code for its End-to-End extension for Chrome to open source via GitHub. End-to-End enables Gmail users to encrypt, sign and verify email messages within the Chrome browser, using OpenPGP. “We’ve always believed strongly that End-To-End mu...
[oss-security] CVE question: Return of POODLE
Hi All, Before i ask my question: It seems some TLS implementations may be vulnerable to POODLE like attack if they use SSL 3.0 type padding and the padding bytes are not checked by the implementation. https://www.imperialviolet.org/2014/12/08/poodleagain.html...
EFF, Privacy Groups Say NIST Crypto Standards Must be Free From Backdoors
The EFF and a long list of civil and privacy groups have sent a letter to NIST, emphasizing the need for the agency to create “a process for establishing secure and resilient encryption standards, free from back doors or other known vulnerabilities.” The letter comes at a time when the agency is ...
Updated srtp package fixes security vulnerability
Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol SRTP, in how the cryptopolicysetfromprofileforrtp function applies cryptographic profiles to an srtppolicy. A remote attacker could...
Medium: golang
Issue Overview: crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors. Affected Packages: golang Issue Correction: Run yum update golang or yum update --advisory ALAS-2014-437 to update your system. N...
joola.io: Weak Random Number Generator for Auth Tokens
https://github.com/joola/joola/blob/a534c3dca1a0deaec99c192978e61a35dd3a9069/lib/common/index.jsL90-L98 Math.random is not sufficient for cryptographic purposes such as authentication tokens. An example replacement that uses window.crypto.getRandomValues is available here:...
