PT-2021-6784 · Document Foundation +9 · Libreoffice +9

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 7.2 prior to 7.2.5 Description: The issue is related to improper certificate validation in LibreOffice, allowing an attacker to create a digitally signed ODF document by manipulating the documentsignatures.xml or...

USN-4516-1: GnuPG vulnerability

It was discovered that GnuPG signatures could be forged when the SHA-1 algorithm is being used. This update removes validating signatures based on SHA-1 that were generated after 2019-01-19. In environments where this is still required, a new option --allow-weak-key-signatures can be used to reve...

CVE-2020-1026

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography ECC implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key a key...

ALPINE-CVE-2019-14855

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18...

UBUNTU-CVE-2017-15090

An issue has been found in the DNSSEC validation component of PowerDNS Recursor from 4.0.0 and up to and including 4.0.6, where the signatures might have been accepted as valid even if the signed data was not in bailiwick of the DNSKEY used to sign it. This allows an attacker in position of...

bind: An error in TSIG authentication can permit unauthorized dynamic updates

A flaw was found in the way BIND handled TSIG authentication for dynamic updates. A remote attacker able to communicate with an authoritative BIND server could use this flaw to manipulate the contents of a zone, by forging a valid TSIG or SIG0 signature for a dynamic update request...

Qolsys IQ Panel Using Hardcoded Encryption Keys Vulnerability

Qolsys IQ Panel is an Android OS based touch screen controller for home automation devices and features. A security vulnerability exists in Qolsys IQ Panel versions prior to 1.5.1. A remote attacker can exploit the vulnerability to create a digital signature for code by cleverly constructing...

FreeBSD Ports: krb5

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2011 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2010-4020

MIT Kerberos 5 (krb5) 1.8.x–1.8.3 is affected by CVE-2010-4020 due to not rejecting RC4 key-derivation checksums, enabling remote authenticated users to forge AD-SIGNEDPATH or AD-KDC-ISSUED signatures and potentially gain privileges. Mitigation/advisories reference MITKRB5-SA-2010-007 and patches...

krb5 -- RFC 3961 key-derivation checksum handling vulnerability

The MIT Kerberos team reports: MIT krb5 releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data. An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the...

Portable Document Format - Specification Signature Collision

Portable Document Format - Specification Signature Collision source: https://www.securityfocus.com/bid/42377/info The Portable Document Format PDF specification is prone to a signature-collision attack when signing PDF documents. An attacker can exploit this issue to create PDF documents containi...

Tsuru-Kame Mail vulnerable in S/MIME signature verification

Overview Tsuru-Kame Mail contains the following vulnerabilities in the S/MIME signature verification: - S/MIME signature verification does not verify the certification path. - S/MIME signature verification does not verify the certification expiration date. The name of the software "Tsuru-Kame Mai...

Fedora Core 5 : gnutls-1.2.10-3 (2006-974)

Thu Sep 14 2006 Tomas Mraz 1.2.10-3 - detect forged signatures - CVE-2006-4790 206411, patch from upstream - Tue May 16 2006 Tomas Mraz - 1.2.10-2 - added missing buildrequires Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

Important gnutls security update

1.0.20-3.2.3 - detect forged signatures - CVE-2006-4790 206411, patch backported from upstream...

USN-339-1: OpenSSL vulnerability

Philip Mackenzie, Marius Schilder, Jason Waddle and Ben Laurie of Google Security discovered that the OpenSSL library did not sufficiently check the padding of PKCS 1 v1.5 signatures if the exponent of the public key is 3 which is widely used for CAs. This could be exploited to forge signatures...

Vulnerability (critical): Digital signature for Adobe Acrobat/Reader plug-in can be forged

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Vulnerability critical: Digital signature for Adobe Acrobat/Reader plug-in can be forged March 24, 2003 SUMMARY =============================================================================== Adobe Acrobat Reader supports plug-ins, i.e. additional...