[SECURITY] Fedora 22 Update: nettle-2.7.1-6.fc22

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

[SECURITY] Fedora 23 Update: mingw-nettle-3.2-1.fc23

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

[SECURITY] Fedora 23 Update: nettle-3.2-1.fc23

Nettle is a cryptographic library that is designed to fit easily in more or less any context: In crypto toolkits for object-oriented languages C++, Python, Pike, ..., in applications like LSH or GNUPG, or even in kernel space...

USN-2883-1: OpenSSL vulnerability

Antonio Sanso discovered that OpenSSL reused the same private DH exponent for the life of a server process when configured with a X9.42 style parameter file. This could allow a remote attacker to possibly discover the server's private DH exponent when being used with non-safe primes...

USN-2863-1: OpenSSL vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that OpenSSL incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

[SECURITY] Fedora 23 Update: mbedtls-2.1.2-1.fc23

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] [DSA 3296-1] libcrypto++ security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3296-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 29, 2015 https://www.debian.org/security/faq -...

Debian DSA-3296-1 : libcrypto++ - security update

Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's privat...

DSA-3296-1 libcrypto++ - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3296-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Rational ClearCase GSKit Encryption Issue Vulnerability

IBM Rational ClearCase is a suite of software configuration management solutions from IBM in the United States. The solution provides version control, workspace management, parallel development support and build auditing. A security vulnerability exists in the implementation of the MSCAPI/MSCNG...

IBM Tivoli Directory Server (ITDS) FREAK Degradation Attack Vulnerability

IBM Tivoli Directory Server is a powerful implementation of LDAP directory services. A security vulnerability exists in IBM Tivoli Directory Server due to the failure of GSKit in this program to properly restrict TLS stateful transmissions. This allows attackers to exploit the vulnerability to...

openssl security update

CentOS Errata and Security Advisory CESA-2015:0715 Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

[SECURITY] Fedora 20 Update: polarssl-1.2.12-1.fc20

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

Mozilla Network Security Services RSA Signature Forgery (CVE-2014-1568)

An RSA signature forgery vulnerability exists in Mozilla Network Security Services NSS, the cryptographic library used in many applications including Firefox and Google Chrome. The vulnerability is a result of improper verification of RSA signatures due to incorrect ASN.1 parsing of the DigestInf...

RSA Security RSAREF 2.0 - Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/843/info A buffer overflow vulnerability exists in the RSAREF cryptographic library which may possibly make any software using the library vulnerable. The vulnerability exists in four functions in the rsa.c source file. T...

USN-2232-3: OpenSSL regression

USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use renegotiation, such as PostgreSQL. This update fixes the problem. Original advisory details: Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS...

GnuTLS Patches Critical Remote Code Execution Bug

GnuTLS, an open source cryptographic library, was a headliner in March because of a critical certificate verification vulnerability that some erroneously put in the same class as Apple’s infamous gotofail bug. The library, used in a number of Linux distributions including Red Hat, Debian and...

OpenSSL Fixes TLS Vulnerability

The maintainers of the OpenSSL library, one of the more widely deployed cryptographic libraries on the Web, have fixed a serious vulnerability that could have resulted in the revelation of 64 KB of memory to any client or server that was connected. The details of the vulnerability, fixed in versi...

Weak Password Used to Access Hypervisor, Deface OpenSSL Site

The OpenSSL Project blames a weak password used at its hosting provider for its recent site defacement. The organization that hosts the ubiquitous open source encryption implementation updated a notice on its website yesterday informing users that attackers used the weak credential to gain contro...