CVE-2017-3224

A vulnerability was discovered in several OSPF implementations, including Quagga. A malicious OSPF peer, or an attacker able to spoof messages from an OSPF peer, could send a crafted message that would result in erasure or alteration of the routing table, resulting in denial of service or incorre...

PT-2017-4203

Name of the Vulnerable Software and Affected Versions Nimbus JOSE+JWT versions prior to 4.36 Description The issue concerns a problem with the construction of ECKey without proper validation of the public x and y coordinates on the specified curve, allowing for an Invalid Curve Attack in certain...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to execute arbitrary code.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created file...

CVE-2016-8021

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file...

CVE-2016-8021

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file...

CVE-2016-8021

CVE-2016-8021 affects McAfee VirusScan Enterprise for Linux (VSEL) 2.0.3 and earlier. The vulnerability is in the web interface’s verification of cryptographic signatures, allowing a remote authenticated attacker to spoof the update server and execute arbitrary code via a crafted input file. Impa...

CVE-2016-8021: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file...

PT-2017-1471

Name of the Vulnerable Software and Affected Versions McAfee VirusScan Enterprise versions 2.0.3 and earlier Description The issue is related to improper verification of cryptographic signatures, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file...

APT - Repository Signing Bypass via Memory Allocation Failure

APT - Repository Signing Bypass via Memory Allocation Failure Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020 == Vulnerability == When apt-get updates a repository that uses an InRelease file clearsigned Release files, this file is processed as follows: First, the InRelease...

APT - Repository Signing Bypass via Memory Allocation Failure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020 == Vulnerability == When apt-get updates a repository that uses an InRelease file clearsigned Release files, this file is processed as follows: First, the InRelease file is downloaded to disk. In a subprocess running the gpgv...

McAfee VirusScan for Linux contains multiple vulnerabilities

Overview McAfee VirusScan for Linux contains multiple vulnerabilities. Description McAfee VirusScan for Linux version 2.0.3 and prior is vulnerable to the following:CWE-200: Information Exposure - CVE-2016-8016 Multiple pages within the web interface utilize a tplt parameter. An authenticated...

Oops! Microsoft Accidentally Leaks Backdoor Keys to Bypass UEFI Secure Boot

It's True — There is no such backdoor that only its creator can access. Microsoft has accidentally leaked the Secret keys that allow hackers to unlock devices protected by UEFI Unified Extensible Firmware Interface Secure Boot feature. What's even worse? It will be impossible for Microsoft to und...

Code injection

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

CVE-2014-8886

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

Mandriva Linux Security Advisory : rpm (MDVSA-2015:056)

Updated rpm packages fix security vulnerabilities : It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system...

[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

AVM FRITZ!Box Firmware Signature Bypass Vulnerability

The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface...

AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

Scientific Linux Security Update : rpm on SL5.x, SL6.x i386/x86_64 (20141209)

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...

Scientific Linux Security Update : rpm on SL7.x x86_64 (20141209)

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...