RLSA-2022:6763 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RHEL 9 : bind (RHSA-2022:6763)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6763 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

bind security update

32:9.11.4-26.P2.10 - Fix memory leak in ECDSA verify processing CVE-2022-38177 - Fix memory leak in EdDSA verify processing CVE-2022-38178...

ALSA-2022:6763 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RHEL 7 : bind (RHSA-2022:6765)

"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6765 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

CLSA-2022-1664476753 Fixed CVEs in bind: CVE-2022-38178, CVE-2022-38177, CVE-2022-2795

CVE-2022-2795: fix possible resolver performance degradation when processing large delegations - CVE-2022-38177: fix memory leak in ECDSA DNSSEC verification code - CVE-2022-38178: fix memory leak in EdDSA DNSSEC verification code...

CLSA-2022-1664475166 Fix CVE(s): CVE-2022-38177, CVE-2022-2795

SECURITY UPDATE: degrade resolver performance - debian/patches/CVE-2022-2795.patch: adds limits in fctxgetaddresses to avoid spending excessive amounts of time on processing large delegations in resolver code in lib/dns/resolver.c. - CVE-2022-2795 SECURITY UPDATE: memory leak -...

ROS-20220929-01

BIND DNS server vulnerability is related to boundary conditions when reusing HTTP connection when requesting statistics from a statistics channel. Exploitation of the vulnerability could allow an attacker, acting remotely, using a managed DNS server to cause a read error outside the boundary...

Security Bulletin: IBM InfoSphere Guardium Database Activity Monitoring is affected by vulnerabilities in OpenSSL (CVE-2014-0076, CVE-2014-0160)

Abstract Security vulnerabilities have been discovered in OpenSSL that affect a 3rd party Component used by IBM InfoSphere Guardium. Content VULNERABILITY DETAILS: CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the...

Security Bulletin: IBM InfoSphere Guardium System x/Flex Systems appliances are affected by vulnerabilities in OpenSSL (CVE-2014-0076, CVE-2014-0160)

Abstract Security vulnerabilities have been discovered in OpenSSL. Content VULNERABILITY DETAILS: CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this...

Security Bulletin: IBM InfoSphere Guardium Data Encryption is affected by vulnerabilities in OpenSSL (CVE-2014-0076, CVE-2014-0160)

Abstract Security vulnerabilities have been discovered in OpenSSL. Content VULNERABILITY DETAILS: CVE-ID:CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could exploit this...

secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

GHSA-Q3F4-9H4P-VGR3 secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

Design/Logic Flaw

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The CVE-2022-41340 issue concerns the secp256k1-js package for Node.js prior to version 1.1.0. The root cause is lack of required r and s validation in the ECDSA implementation, which enables signature forgery. Affected software: secp256k1-js before 1.1.0. The recommended remediation is to upgrad...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

secp256k1-js 数据伪造问题漏洞

secp256k1-js is a pure JS implementation of secp256k1 for signing, verifying, and recovering ECDSA by the individual developer Lio Liou lionello. A security vulnerability exists in versions of secp256k1-js prior to 1.1.0, which stems from the lack of r and s validation in the implementation of...