92 matches found
iOS Zero-Day Attacks: Experts Uncover Deeper Insights into Operation Triangulation
The TriangleDB implant used to target Apple iOS devices packs in at least four different modules to record microphone, extract iCloud Keychain, steal data from SQLite databases used by various apps, and estimate the victim's location. The new findings come from Kaspersky, which detailed the great...
Weak Cryptography
github.com/bishopfox/sliver is vulnerable to weak cryptography. The vulnerability exists because it does not properly implement Nacl Box libsodium, which allows an attacker to execute arbitrary codes on implanted devices and intercept user responses...
SUSE CVE-2015-3335
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandboxlinux/naclsandboxlinux.cc in Google Chrome before 42.0.2311.90 does not have RLIMITAS and RLIMITDATA limits for Native Client aka NaCl processes, which might make it easier for remote attackers to conduct...
Crypto Miners Using Tox P2P Messenger as Command and Control Server
Threat actors have begun to use the Tox peer-to-peer instant messaging service as a command-and-control method, marking a shift from its earlier role as a contact method for ransomware negotiations. The findings from Uptycs, which analyzed an Executable and Linkable Format ELF artifact "72client"...
[SECURITY] Fedora 34 Update: toxcore-0.2.13-1.fc34
Tox is a peer to peer serverless instant messenger aimed at making security and privacy easy to obtain for regular users. It uses NaCl for its encryption and authentication...
[SECURITY] Fedora 35 Update: toxcore-0.2.13-1.fc35
Tox is a peer to peer serverless instant messenger aimed at making security and privacy easy to obtain for regular users. It uses NaCl for its encryption and authentication...
Fedora: Security Advisory for toxcore (FEDORA-2021-8026e9b394)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
RUSTSEC-2021-0137 sodiumoxide is deprecated
Alternatives may be found - not in any specific order: - libsodium-sys-stable - dryoc - RustCrypto/nacl-compat cryptobox, cryptokx, cryptosecretstream - RustCrypto/xsalsa20poly1305 cryptosecretbox - Signatory - ed25519-compact - ed25519-dalek - ring Recommendations can be also found from: - Aweso...
sodiumoxide is deprecated
Alternatives may be found - not in any specific order: - libsodium-sys-stable - dryoc - RustCrypto/nacl-compat cryptobox, cryptokx, cryptosecretstream - RustCrypto/xsalsa20poly1305 cryptosecretbox - Signatory - ed25519-compact - ed25519-dalek - ring Recommendations can be also found from: - Aweso...
GHSA-5W25-HXP5-H8C9 Duplicate Advisory: Improper Verification of Cryptographic Signature
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r96-8g3x-g36m. This link is maintained to preserve external references. Original Description tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser hashing, random, encryption, decryption,...
Duplicate Advisory: Improper Verification of Cryptographic Signature
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r96-8g3x-g36m. This link is maintained to preserve external references. Original Description tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser hashing, random, encryption, decryption,...
CVE-2021-32685
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser hashing, random, encryption, decryption, signatures, conversions, used by TogaTech.org. In versions prior to 7.0.3, the verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature that has a SHA-512 ha...
Design/Logic Flaw
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser hashing, random, encryption, decryption, signatures, conversions, used by TogaTech.org. In versions prior to 7.0.3, the verifyWithMessage method of tEnvoyNaClSigningKey always returns true for any signature that has a SHA-512 ha...
CVE-2021-32685
CVE-2021-32685 affects tEnvoy (used by TogaTech.org) where the verifyWithMessage function in tEnvoyNaClSigningKey incorrectly returns true for SHA-512 hashes that match the message hash, even if the signature is invalid. This flaw is present in versions prior to 7.0.3. The issue is patched in v7....
tEnvoy Data Forgery Issue Vulnerability
tEnvoy is an open source package. Used in node.js and the browser PGP, NaCl and PBKDF2 hash , random , encryption, decryption, signatures, conversion. A vulnerability exists in tEnvoy versions prior to 7.0.3 for data forgery issues. No detailed vulnerability details are provided at this time...
NaCl Is Not a High-Level API
When talking about high-level application cryptography APIs I usually hear mentioned libsodium, Tink, pyca/cryptography, and NaCl. One of these things is not like the others! The value NaCl had 10 years ago was that it was an opinionated library at a time when all cryptography libraries were...
CVE-2015-0565
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
DEBIAN-CVE-2015-0565
NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible...
