CVE-2012-5577

CVE-2012-5577 affects the Python keyring library prior to 0.10, where keyring files were created with world-readable permissions. This is the concrete detail available across the connected sources; no additional exploit vectors, systems, or remediation steps are specified in the provided document...

CVE-2012-5577

Python keyring lib before 0.10 created keyring files with world-readable permissions...

CVE-2012-5577

Python keyring lib before 0.10 created keyring files with world-readable permissions...

CVE-2012-5577

Python keyring lib before 0.10 created keyring files with world-readable permissions...

CVE-2012-5577: Incorrect Default Permissions

Python keyring lib before 0.10 created keyring files with world-readable permissions...

PT-2019-6792

Name of the Vulnerable Software and Affected Versions Python keyring lib versions prior to 0.10 Description The issue concerns the Python keyring library, where versions before 0.10 created keyring files with world-readable permissions. This could potentially expose sensitive information...

CVE-2019-8338

The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 9 and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the...

UBUNTU-CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

Code injection

The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 9 and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2019-8338

The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 9 and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service attacks. A local, authenticated attacker could exploit the flawed Keyring Handler component and create keyrings for other users via keyctl commands...

NULL Pointer Dereference

Linux kernel is vulnerable to NULL pointer dereference attacks. This is due to mishandling of node-splitting in assocarray implementation in assocarrayinsertintoterminalnode function in lib/assocarray.c. A local users could cause a denial of service via a crafted application, as demonstrated by t...

PT-2019-18974

Name of the Vulnerable Software and Affected Versions Airmail GPG-PGP Plugin versions 1.0 9 and earlier Description The issue concerns the signature verification routine, which fails to verify the status of the signature and the validity of the signing key. This allows remote attackers to spoof...

Signature Verification Bypass

Linux kernel is vulnerable to signature validation bypass attacks. This is because the root can gain direct access to an internal keyring, such as '.dnsresolver' in RHEL-7 or '.builtintrustedkeys' upstream, by joining it as its session keyring.Root user could bypass module signature verification ...

Use-After-Free

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. A flaw was found in the Linux kernel's keyring handling code, where in keyrejectandlink an uninitialised variable would eventually lead to arbitrary free...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. It was found that the Linux kernel's keyring implementation would leak memory when adding a key to a keyring via the addkey function. A local attacker could use this flaw to exhaust all available memory on the system...

Information Disclosure

The GNU Privacy Guard GnuPG or GPG is a tool for encrypting data and creating digital signatures, compliant with the proposed OpenPGP Internet standard and the S/MIME standard. It was found that GnuPG was vulnerable to the Yarom/Falkner flush+reload cache side-channel attack on the RSA secret...

GNOME Keyring Unauthenticated Access

The vulnerability of the GNOME Keyring’s user name and password storage service is related to errors in managing registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...