nettle security update

CentOS Errata and Security Advisory CESA-2016:2582 An update for nettle is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Oracle Linux 7 : nettle (ELSA-2016-2582)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2582 advisory. - Use a cache-silent version of mpzpowm to prevent cache-timing attacks against RSA and DSA in shared VMs. 1364897,CVE-2016-6489 Tenable has extracted...

RHEL 7 : nettle (RHSA-2016:2582)

An update for nettle is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

[SECURITY] Fedora 24 Update: kf5-libkleo-16.08.2-1.fc24

KDE PIM cryptographic library...

SAP SAPCRYPTOLIB Component Security Bypass Vulnerability

SAP SAPCRYPTOLIB is a cryptographic library of the German company SAP. A security bypass vulnerability exists in the SAP SAPCRYPTOLIB component and can be exploited by an attacker to bypass security restrictions and perform unauthorized operations...

USN-3087-2: OpenSSL regression

USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Shi Lei discovered that OpenSSL incorrectly handled the OCSP Statu...

Critical DoS Flaw found in OpenSSL — How It Works

The OpenSSL Foundation has patched over a dozen vulnerabilities in its cryptographic code library, including a high severity bug that can be exploited for denial-of-service DoS attacks. OpenSSL is a widely used open-source cryptographic library that provides encrypted Internet connections using...

USN-3087-1: OpenSSL vulnerabilities

Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. A remote attacker could possibly use this issue to cause memory consumption, resulting in a denial of service. CVE-2016-6304 Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointe...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...

Updated nettle/nettle2.7 packages fix security vulnerability

The cryptographic library nettle had a potential information leak problem reported. RSA code is vulnerable to cache sharing related attacks CVE-2016-6489...

[SECURITY] [DLA 593-1] nettle security update

Package : nettle Version : 2.4-3+deb7u1 CVE ID : CVE-2016-6489 Debian Bug : 832983 The cryptographic library nettle had a potential information leak problem reported. CVE-2016-6489 RSA code is vulnerable to cache sharing related attacks. For Debian 7 "Wheezy", this problems has been fixed in...

The vulnerability of the Java Platform software platform allows a malicious actor to simplify the process of decoding messages remotely.

A vulnerability in the Java Platform software framework, related to a bug in the ssl3getkeyexchange function in the s3clnt.c file of the OpenSSL cryptographic library. Exploiting this vulnerability could allow an attacker to simplify the decryption process by using an insufficiently secure RSA ke...

The vulnerability of the JRockit software platform allows a malicious actor to simplify the process of decoding messages remotely.

A vulnerability in the JRockit software platform is related to a bug in the ssl3getkeyexchange function in the s3clnt.c file of the OpenSSL cryptographic library. Exploiting this vulnerability could allow an attacker to simplify the decryption process by using an insufficiently secure RSA key...

Vulnerabilities of the enterprise automation system 1C:Enterprise, allowing a malicious individual to trigger service failures or gain access to encrypted data without knowing the encryption key

Multiple vulnerabilities in the OpenSSL cryptographic package of the 1C: enterprise automation system allow a malicious actor to remotely cause service failures or gain access to encrypted data without knowing the encryption key...

OpenSSL EVP_EncodeUpdate Overflow Vulnerability

OpenSSL is a general-purpose open source cryptographic library that implements Secure Sockets Layer and Secure Transport Layer protocols and can support a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure hashing algorithms, and so on. An overflow...

[SECURITY] [DSA 3565-1] botan1.10 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3565-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 02, 2016 https://www.debian.org/security/faq -...

nss: Use-after-free during processing of DER encoded keys in NSS (MFSA 2016-36)

A use-after-free flaw was found in the way NSS processed certain DER Distinguished Encoding Rules encoded cryptographic keys. An attacker could use this flaw to create a specially crafted DER encoded certificate which, when parsed by an application compiled against the NSS library, could cause th...

libcrypto++ Timing Attack Vulnerability

libcrypto++ is a general-purpose C++ cryptographic library. A security vulnerability exists in libcrypto++, which can be exploited by attackers to perform timing attacks...

nss: Use-after-free during processing of DER encoded keys in NSS (MFSA 2016-36)

A use-after-free flaw was found in the way NSS processed certain DER Distinguished Encoding Rules encoded cryptographic keys. An attacker could use this flaw to create a specially crafted DER encoded certificate which, when parsed by an application compiled against the NSS library, could cause th...

[SECURITY] Fedora 23 Update: botan-1.10.12-1.fc23

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...