SUSE SLES12 Security Update : squid (SUSE-SU-2017:0116-1)

This update for squid fixes the following issues : - CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached bsc1016168 - CVE-2014-9749: Prevent nonce replay in Dige...

SUSE-SU-2017:0116-1 Security update for squid

This update for squid fixes the following issues: - CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached bsc1016168 - CVE-2014-9749: Prevent nonce replay in Diges...

BSA-2017-501

Security Advisory ID : BSA-2017-501 Component : Apache HTTPD Revision : 2.0: Final In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to modauthdigest can cause the server to crash, and each instance continues to crash even for subsequently valid requests...

Design flaws in the Android version of the Far Eastern Express app client

Yuancheng Express app is a life service application, a mobile logistics platform. There is a design vulnerability in the Far Cheng Express app client for Android. Due to the digest digest algorithm can be cracked, allowing an attacker to exploit the vulnerability to reset the password of any user...

CVE-2016-1550

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

Design/Logic Flaw

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

DEBIAN-CVE-2016-1550

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

CVE-2016-1550

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

CVE-2016-1550

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

CVE-2016-1550

Removed by vendor...

CVE-2016-1550: Exposure of Sensitive Information to an Unauthorized Actor

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key...

uninitialized random

libcurl's new internal function that returns a good 32-bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary...

PT-2016-7788

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.52.1 Description The issue arises from an uninitialized random value in libcurl's internal function, which is used to generate nonces for Digest and NTLM authentication, boundary strings in HTTP formposts, and more. Th...

PT-2016-3151

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.23 Description The issue is caused by insufficient input validation in the mod auth digest module of the Apache HTTP Server. This can be exploited by a remote attacker to cause the server to crash...

Fedora 25 : 1:tomcat (2016-f4a443888b)

This updates includes a rebase from tomcat 8.0.32 up to 8.0.36 to resolve : - rhbz1349469 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service and also includes the following bug fixes : - rhbz1341850 tomcat-jsvc.service has TOMCATUSER value hard-coded -...

UBUNTU-CVE-2016-9243

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digestsize...

sudo security, bug fix, and enhancement update

1.8.6p7-20 - RHEL 7.3 erratum - fixed visudo's -q flag Resolves: rhbz1350828 1.8.6p7-19 - RHEL 7.3 erratum - removed INPUTRC from envkeep to prevent a potential info leak Resolves: rhbz1340700 1.8.6p7-18 - RHEL 7.3 erratum - removed requiretty flag from the default sudoers policy - backported...

CVE-2016-9243

HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digestsize...

Ubuntu 14.04 LTS / 16.04 LTS : NTP vulnerabilities (USN-3096-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3096-1 advisory. Aanchal Malhotra discovered that NTP incorrectly handled authenticated broadcast mode. A remote attacker could use this issue to perform a...

RUSTSEC-2016-0005 rust-crypto is unmaintained; switch to a modern alternative

The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive. NOTE: The old rust-crypto crate with hyphen should not be confused with similarly named new RustCrypto GitHub Org without hyphen. The GitHub Org is actively maintained. We recommend you switc...