Linux Variant of REvil Ransomware Targets VMware’s ESXi, NAS Devices

UPDATE Cybercriminals behind a string of high-profile ransomware attacks, including one extorting $11 million from JBS Foods last month, have ported their malware code to the Linux operating system. The unusual move is an attempt to target VMware’s ESXi virtual machine management software and...

ARM Mbed OS 输入验证错误漏洞

ARM Mbed OS is a suite of open source embedded operating systems dedicated to the Internet of Things from ARM UK. Arm mbed 6.3.0 suffers from an input validation error vulnerability that stems from incorrect memory allocation could lead to arbitrary memory allocation, which could result in...

ARM Mbed OS 输入验证错误漏洞

ARM Mbed OS is a suite of open source embedded operating systems dedicated to the Internet of Things from ARM UK. An input validation error vulnerability exists in the Arm mbed-uallaoc memory library version 1.3.0, which stems from the fact that incorrect memory allocation could lead to arbitrary...

PT-2021-6813

Name of the Vulnerable Software and Affected Versions Mbed TLS version 2.24.0 Description A side-channel vulnerability in base64 PEM file decoding exists, allowing system-level attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software runni...

DEBIAN-CVE-2021-26529

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 compiled with mbedTLS support is vulnerable to remote OOB write attack via connection request after exhausting memory pool...

[SECURITY] Fedora 32 Update: mbedtls-2.16.9-1.fc32

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

Fedora: Security Advisory for mbedtls (FEDORA-2020-e2d7a16ae9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for mbedtls (FEDORA-2020-9e97ec4cba)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-6686 · Mbed Tls +2 · Mbed Tls +2

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions prior to 2.25.0 Mbed TLS versions prior to 2.16.9 LTS Mbed TLS versions prior to 2.7.18 LTS Description: The issue is related to an incorrect comparison of NULL with an empty array in the implementation of TLS and SSL...

[SECURITY] Fedora 33 Update: mbedtls-2.16.8-1.fc33

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 31 Update: mbedtls-2.16.8-1.fc31

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

FreeBSD : Mbed TLS -- Local side channel attack on classical CBC decryption in (D)TLS (4c69240f-f02c-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : When decrypting/authenticating DTLS record in a connection using a CBC ciphersuite without the Encrypt-then-Mac extension RFC 7366, Mbed TLS used dummy rounds of the compression function associated with the hash used for HMAC in order to hide the length of the...

FreeBSD : Mbed TLS -- Local side channel attack on RSA and static Diffie-Hellman (bcdeb6d2-f02d-11ea-838a-0011d823eebd)

Manuel Pegourie-Gonnard reports : An attacker with access to precise enough timing and memory access information typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world can recover the private keys used in RSA or static finite-field...

DEBIAN-CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...

CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...

CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...

CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...

PT-2021-6568

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.24.0 Description The issue is related to a buffer over-read in the mbedtls x509 crl parse der function, which can lead to a denial of service. This can be exploited by a remote attacker. The function is part of...

CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...

CVE-2020-16150

A Lucky 13 timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length...