CVE-2014-8872

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

CVE-2014-8872

Summary: CVE-2014-8872 covers an improper verification of cryptographic signatures in AVM FRITZ!Box firmware images. Affected products (examples): FRITZ!Box 6810 LTE (firmware 5.22+), FRITZ!Box 6840 LTE (firmware 5.23+), and other models with firmware 5.50. Root cause (as described): The firmware...

[SECURITY] Fedora 26 Update: torbrowser-launcher-0.2.8-1.fc26

Tor Browser Launcher is intended to make Tor Browser easier to install and use for GNU/Linux users. You install torbrowser-launcher from your distribution's package manager and it handles everything else: Downloads and installs the most recent version of Tor Browser in your lan guage and for your...

CVE-2017-3224

A vulnerability was discovered in several OSPF implementations, including Quagga. A malicious OSPF peer, or an attacker able to spoof messages from an OSPF peer, could send a crafted message that would result in erasure or alteration of the routing table, resulting in denial of service or incorre...

The vulnerability of the McAfee VirusScan Enterprise anti-virus software allows a hacker to execute arbitrary code.

The vulnerability of the McAfee VirusScan Enterprise antivirus software is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code using a specially created file...

CVE-2016-8021

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file...

CVE-2016-8021

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux VSEL 2.0.3 and earlier allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file...

CVE-2016-8021

CVE-2016-8021 affects McAfee VirusScan Enterprise for Linux (VSEL) 2.0.3 and earlier. The vulnerability is in the web interface’s verification of cryptographic signatures, allowing a remote authenticated attacker to spoof the update server and execute arbitrary code via a crafted input file. Impa...

APT - Repository Signing Bypass via Memory Allocation Failure

APT - Repository Signing Bypass via Memory Allocation Failure Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020 == Vulnerability == When apt-get updates a repository that uses an InRelease file clearsigned Release files, this file is processed as follows: First, the InRelease...

APT - Repository Signing Bypass via Memory Allocation Failure

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1020 == Vulnerability == When apt-get updates a repository that uses an InRelease file clearsigned Release files, this file is processed as follows: First, the InRelease file is downloaded to disk. In a subprocess running the gpgv...

McAfee VirusScan for Linux contains multiple vulnerabilities

Overview McAfee VirusScan for Linux contains multiple vulnerabilities. Description McAfee VirusScan for Linux version 2.0.3 and prior is vulnerable to the following:CWE-200: Information Exposure - CVE-2016-8016 Multiple pages within the web interface utilize a tplt parameter. An authenticated...

Oops! Microsoft Accidentally Leaks Backdoor Keys to Bypass UEFI Secure Boot

It's True — There is no such backdoor that only its creator can access. Microsoft has accidentally leaked the Secret keys that allow hackers to unlock devices protected by UEFI Unified Extensible Firmware Interface Secure Boot feature. What's even worse? It will be impossible for Microsoft to und...

CVE-2014-8886

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

Code injection

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

Mandriva Linux Security Advisory : rpm (MDVSA-2015:056)

Updated rpm packages fix security vulnerabilities : It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system...

[RT-SA-2014-010] AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

AVM FRITZ!Box Firmware Signature Bypass Vulnerability

The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface...

AVM FRITZ!Box Firmware Signature Bypass

Advisory: AVM FRITZ!Box: Firmware Signature Bypass The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if t...

Scientific Linux Security Update : rpm on SL5.x, SL6.x i386/x86_64 (20141209)

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...

Scientific Linux Security Update : rpm on SL7.x x86_64 (20141209)

It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and...