OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected...

OpenJDK: insufficient DSA key parameters checks (Security, 8138593)

It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0008) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - A directory traversal vulnerability exists that allows a remote attacker to read arbitrary files. CVE-2011-0426 - An information disclosure vulnerability exists due to...

Secret Net 7 and Secret Net Studio 8 - Privilege Escalation

Exploit for windows platform in category local exploits Source: https://github.com/Cr4sh/secretnetexpl Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit. 0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges...

OpenSSL: Double-free in DSA code

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA Digital Signature Algorithm private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash...

PT-2016-1332

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g MySQL Server versions 5.6.29 and earlier MySQL Server versions 5.7.11 and earlier Description A double free vulnerability in the dsa priv decode function in...

Python-rsa signature forgery-vulnerability warning-the black bar safety net

! By looking at the python-rsa source code, we found that it is the presence of a vulnerability is based on Bleichenbacher'0 6 attack research out for the RSA signature forgery of a simple variant, is due to the public key index is too low. The vulnerability can lead to arbitrary information to...

CVE-2015-7024

Untrusted search path vulnerability in Apple OS X before 10.11.1 allows local users to bypass intended Gatekeeper restrictions and gain privileges via a Trojan horse program that is loaded from an unexpected directory by an application that has a valid Apple digital signature...

Qolsys IQ Panel Security Bypass Vulnerability

Qolsys IQ Panel is an Android OS based touch screen controller for home automation devices and features. A security bypass vulnerability exists in Qolsys IQ Panel versions prior to 1.5.1 that fails to validate the digital signature of software updates. An attacker could exploit this vulnerability...

CVE-2015-6033

CVE-2015-6033 affects the Qolsys IQ Panel (aka QOL) before 1.5.1. Root cause: the device does not verify digital signatures of software updates, allowing a man‑in‑the‑middle to deliver a modified update and bypass access restrictions. Impact: remote, unauthenticated attacker could inject maliciou...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

Updated libcryptopp package fixes security vulnerability

Evgeny Sidorov discovered that libcryptopp did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user's private key CVE-2015-2141...

PEframe - Tool to perform static analysis on Portable Executable malware

PEframe is a open source tool to perform static analysis on Portable Executable malware. Usage $ peframe malware.exe $ peframe --option malware.exe Options --json Output in json --import Imported function and dll --export Exported function and dll --dir-import Import directory --dir-export Export...

openSUSE Security Update : libcryptopp (openSUSE-2015-504)

libcryptopp was updated to fix one security issue. This security issue was fixed : - CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 did not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allowed...

CVE-2015-2141

libcrypt++ 5.6.2 contains a timing-attack vulnerability in InvertibleRWFunction::CalculateInverse used with Rabin–Williams signatures, enabling remote extraction of private keys. Affected component is the private-key blinding during Rabin–Williams operations; impact is private-key disclosure unde...

CVE-2015-2141

The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack...

Debian Security Advisory DSA 3296-1 (libcrypto++ - security update)

Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow remote attackers to mount a timing attack and retrieve the user OpenVAS...

DSA-3296-1 libcrypto++ - security update

Bulletin has no description...

Duqu 2.0 Attackers Used Stolen Foxconn Certificate to Sign Driver

The attackers behind the recently disclosed Duqu 2.0 APT have used stolen digital certificates to help sneak their malware past security defenses, and one of the certificates used in the attacks was issued to Foxconn, the Chinese company that manufactures products for Apple, BlackBerry, Dell, and...