CVE-2021-24117: Observable Discrepancy

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

CVE-2021-24119

In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single...

CVE-2021-24116: Observable Discrepancy

In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level administrator attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped,...

Trusted Firmware M security vulnerabilities

ARM Trusted Firmware M TFM is an open source software from ARM UK. It provides a set of highly configurable software components to create a trusted execution environment. A security vulnerability exists in Trusted Firmware Mbed TLS that stems from a side-channel vulnerability in base64 PEM file...

Baidu Rust SGX SDK security vulnerabilities

Baidu Rust SGX SDK is a Rust language development kit for Intel SGX Trusted Computing Platform from Baidu, China. Baidu Rust SGX SDK suffers from a security vulnerability, which originates from a side-channel vulnerability in base64 PEM file decoding in Rust SGX 1.1.3. An attacker can exploit the...

wolfSSL security vulnerabilities

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from Wolfssl, Inc. in the United States. A security vulnerability exists in wolfSSL due to an observable timing difference in base64 PEM decoding. A local user could gain access to sensitiv...

Updated botan2 packages fix security vulnerability

Updated botan2 packages fix security vulnerability: In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations base32, base58, base64, and hex CVE-2021-24115...

QUIC SPICE Buffer Overflow DoS

The vulnerability of the image decoding process in the QUIC rendering system for remote virtual desktops SPICE involves copying buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, a...

CVE-2021-32714

hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes...

ImageMagick ReadMIFFImage Infinite Loop DoS

The vulnerability of the ReadMIFFImage function in the coders/miff.c component of the ImageMagick console graphics editor is related to the infinite execution of a loop. Exploiting this vulnerability allows an attacker to cause a service failure by using a specially created MIFF image...

h2o:h2o-fuzzer-http3: Heap-buffer-overflow in decode_header_value_literal

Project: https://github.com/h2o/h2o.git Detailed Report: https://oss-fuzz.com/testcase?key=4668461354713088 Project: h2o Fuzzing Engine: libFuzzer Fuzz Target: h2o-fuzzer-http3 Job Type: libfuzzerasanh2o Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62800000bda9 Cras...

SUSE-SU-2021:2180-1 Security update for libsolv

This update for libsolv fixes the following issues: Security issues fixed: - CVE-2019-20387: Fixed heap-buffer-overflow in repodataschema2id bsc1161510 - CVE-2021-3200: testcaseread: error out if repos are added or the system is changed too late bsc1186229 Other issues fixed: - backport support f...

SUSE-SU-2021:2145-1 Security update for libsolv

This update for libsolv fixes the following issues: Security issues fixed: - CVE-2019-20387: Fixed heap-buffer-overflow in repodataschema2id bsc1161510 - CVE-2021-3200: testcaseread: error out if repos are added or the system is changed too late bsc1186229 Other issues fixed: - backport support f...

openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action

Open vSwitch aka openvswitch has a use-after-free in decodeNXASTRAWENCAP called from ofpactdecode and ofpactsdecode during the decoding of a RAWENCAP action...

libwebp Heap Buffer Overflow Code Execution

The vulnerability of the libwebp library for encoding and decoding WebP images is related to the use of an uninitialized variable. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

libwebp Uncontrolled Resource Consumption DoS

The vulnerability of the libwebp library for encoding and decoding WebP images is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

libwebp Heap Buffer Overflow RCE

The vulnerability of the libwebp library for encoding and decoding WebP images is related to buffer overflow in the “bucket” mechanism. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by creating a specially crafted file...

libwebp Use-After-Free RCE

The vulnerability of the libwebp library for encoding and decoding WebP images is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code by creating a specially crafted file...

libwebp Heap Buffer Overflow Info Disclosure

The vulnerability of the libwebp library for encoding and decoding WebP images is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information by creating a specially crafted file...

libwebp Heap Buffer Overflow Info Disclosure

The vulnerability of the libwebp library for encoding and decoding WebP images is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information by creating a specially crafted file...