Updated rpm packages fix security vulnerabilities

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...

RHEL 7 : rpm (RHSA-2014:1976)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1976 advisory. The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying,...

Amazon Linux AMI : rpm (ALAS-2014-458)

It was found that RPM could encounter an integer overflow, leading to a stack-based overflow, while parsing a crafted CPIO header in the payload section of an RPM file. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during...

Important: Red Hat Security Advisory: rpm security update

Updated rpm packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for eac...

Important: Red Hat Security Advisory: rpm security update

Updated rpm packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: rpm security update

Updated rpm packages that fix one security issue are now available Red Hat Enterprise Linux 5.6 Long Life, Red Hat Enterprise Linux 5.9 Extended Update Support, Red Hat Enterprise Linux 6.2 Advanced Update Support, and Red Hat Enterprise Linux 6.4 Extended Update Support, Red Hat Enterprise Linux...

Google Adds Hardware Security Key For Account Protection

Google is introducing an improved two-factor authentication system for Gmail and its other services that uses a tiny hardware token that will only work on legitimate Google sites. The new Security Key system is meant to help defeat attacks that rely on highly plausible fake sites that are designe...

Cobham thraneLINK improper verification of firmware updates vulnerability

Overview Cobham's thraneLINK protocol does not verify cryptographic signatures for firmware updates before installing them. This may allow an attacker to deploy a malicious firmware update to the device. Description CWE-347: Improper Verification of Cryptographic Signature IOActive reports that...

CVE-2014-1498: Improper Verification of Cryptographic Signature

The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service application crash via vectors that trigger generation of a key that supports the Elliptic Curve...

CVE-2013-5182

Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message...

Code injection

Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message...

CVE-2013-5182

Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message...

PT-2013-5427

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.9 Description The issue allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message. This is achieved by using the multipart/signed content type within an unsigned...

CVE-2013-5182: Undefined Security Weakness

Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message...

Instagram Crypto Issue / Hardcoded Key

Affected app: Instagram for Android Affected versions: 4.0.2 and 4.1.2, probably also earlier versions as well as iOS affected. Summary After the Instagram iOS vulnerability discovered last year 1, the app's HTTP API has been extended with a cryptographic authentication for changes like "likes" a...

Karsten Nohl Demonstrates SIM Card Root Attack At Black Hat

LAS VEGAS–Thanks to manufacturers employing old, weak encryption on SIM cards, researchers have found a way to root the cards and get access to billions of mobile devices. German security researcher Karsten Nohl of Security Research Labs demonstrated the SIM card attack in his talk at the Black H...

SIM Card Vulnerability Could Affect Millions of Cell Phones

As many as 750 million mobile phones could be vulnerable to an encryption flaw on certain types of SIM cards, a German cryptographer and researcher warned over the weekend. Karsten Nohl, the founder of Security Research Labs in Berlin, unveiled preliminary research on his blog behind the flaw in...

CVE-2013-4787

Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature, probably involving multiple...

Android Master Key Bug Details Made Public

The details of the Android vulnerability that enables an attacker to create a malicious update to an APK file without breaking its cryptographic signature have become public but it appears as though Google will have a patch ready for the flaw by the time it’s fully disclosed early next month. The...

APK duplicate file

Android does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file APK that is modified in a way that does not violate the cryptographic signature. Android security bug 8219321...