1933 matches found
SUSE SLED12 / SLES12 Security Update : libXdmcp (SUSE-SU-2017:1862-1)
This update for libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046 Note that Tenable Network Security has extracted the preceding description block directly from th...
openSUSE: Security Advisory for xorg-x11-server (openSUSE-SU-2017:1885-1)
The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Security update for xorg-x11-server (important)
This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize t...
SUSE-SU-2017:1868-1 Security update for xorg-x11-libXdmcp
This update for xorg-x11-libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046...
SUSE-SU-2017:1862-1 Security update for libXdmcp
This update for libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046...
SA153: NSS Vulnerabilities Apr-May 2017
SUMMARY Symantec Network Protection products using affected versions of NSS are susceptible to two security vulnerabilities. A remote attacker can send empty SSLv2 messages and cause denial of service through application crashes. An attacker can also have unspecified impact by exploiting a...
openSUSE Security Update : libXdmcp (openSUSE-2017-789)
This update for libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable boo1025046 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...
CVE-2017-0897
ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...
Remote code execution
ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...
CVE-2017-0897
ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...
Unsafe Signing Using A Broken Entropy Sources
crypto/ecdsa in github.com/golang/go is vulnerable to unsafe signing. It can happen because it uses a signing key generated using a broken entropy of rand...
CVE-2016-2564
Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...
Truehunter - Tool to detect TrueCrypt containers
The goal of Truehunter is to detect TrueCrypt containers using a fast and memory efficient approach. It was designed as a PoC some time ago as I couldn't find any open source tool with the same functionality. Installation Just use with Python 2.7, it does not need any additional libraries. usage:...
libXdmcp -- insufficient entropy generating session keys
The freedesktop and x.org project reports: It was discovered that libXdmcp before 1.1.3 used weak entropy to generate session keys on platforms without arc4randombuf but with getentropy. On a multi-user system using xdmcp, a local attacker could potentially use information available from the...
X.org Privilege Escalation / Use-After-Free / Weak Entropy Vulnerabilities
Exploit for windows platform in category local exploits Multiple Vulnerabilities in X.org ================================= Overview -------- Vendor: X.org/Freedesktop.org Vendor URL: https://www.x.org/wiki/ Credit: X41 D-Sec GmbH, Eric Sesterhenn Advisory-URL:...
CVE-2017-2626
It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...
CVE-2017-2625
It was discovered that libXdmcp used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions...
X.org Privilege Escalation / Use-After-Free / Weak Entropy
X41 D-Sec GmbH Security Advisory: X41-2017-001 Multiple Vulnerabilities in X.org ================================= Overview -------- Vendor: X.org/Freedesktop.org Vendor URL: https://www.x.org/wiki/ Credit: X41 D-Sec GmbH, Eric Sesterhenn Advisory-URL:...
crackle - Crack Bluetooth Smart (BLE) Encryption
crackle cracks BLE Encryption AKA Bluetooth Smart. crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK Temporary Key. With the TK and other data collected from the pairing process, the STK Short Term Key and later the LTK Long Ter...