856 matches found
CVE-2018-12436
wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physic...
CVE-2018-12436
wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physic...
Memory corruption
wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physic...
CVE-2018-12436
wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physic...
wolfSSL ROHNP Vulnerability
wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in the wolfcrypt/src/ecc.c file in versions prior to wolfSSL 3.15.1.patch. An attacker can exploit this...
CVE-2018-0495
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. T...
CVE-2018-0495: Observable Discrepancy
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the gcryeccecdsasign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. T...
PT-2018-2344
Name of the Vulnerable Software and Affected Versions Libgcrypt versions prior to 1.7.10 Libgcrypt versions 1.8.x prior to 1.8.3 Description The issue is related to the gcry ecc ecdsa sign function in the cipher/ecc-ecdsa.c file of the Libgcrypt cryptographic library. It allows an attacker to...
ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)
reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: GHSA-4662-J96G-MV46...
ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)
reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: OSV:GHSA-4662-J96G-MV46...
ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)
reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: MEND:CVE-2016-10548...
PT-2018-4470
Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05 security patch level Description The issue occurs while processing QSEE Syscall 'qsee macc gen ecc privkey' in Android, resulting in an untrusted pointer dereference. This could lead to arbitrary write. The...
Infineon RSA library does not properly generate RSA key pairs
Overview The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs, which may allow an attacker to recover the RSA private key corresponding to an RSA public key generated by this library. This vulnerability is often cited as "ROCA" in the media. Description...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
CVE-2017-0379
Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c...
gnutls: Use-of-uninitialized-value in ecc_256_modq
Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://oss-fuzz.com/testcase?key=6126560014761984 Project: gnutls Fuzzer: libFuzzergnutlsclientfuzzer Fuzz target binary: gnutlsclientfuzzer Job Type: libfuzzermsangnutls Platform Id: linux Crash Type: Use-of-uninitialized-value Cras...