OpenPGP, S/MIME Mail Client Vulnerabilities

The CERT Coordination Center CERT/CC has released information on email client vulnerabilities that can reveal plaintext versions of OpenPGP- and S/MIME-encrypted emails. A remote attacker could exploit these vulnerabilities to obtain sensitive information. NCCIC encourages users and administrator...

OpenPGP and S/MIME mail client vulnerabilities

Overview Mail clients may leak plaintext messages while decrypting OpenPGP and S/MIME messages. Description Email clients supporting the OpenPGP or S/MIME standards may be vulnerable to a CBC/CFB gadget attack which may allow an attacker to inject content into an encrypted email which would...

SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2018:1076-1)

LibreOffice was updated to version 6.0.3. Following new features were added : - The Notebookbar, although still an experimental feature, has been enriched with two new variants: Grouped Bar Full for Writer, Calc and Impress, and Tabbed Compact for Writer. The Special Characters dialog has been...

[SECURITY] Fedora 26 Update: gnupg2-2.2.6-1.fc26

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

Denial Of Service (DoS)

github.com/golang/crypto is vulnerable to denial of service DoS attacks. The vulnerability exists as it is possible to cause an infinite amount of packet readers to be created through an OpenPGP message...

Debian DLA-1219-1 : enigmail security update

Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked signatures, plain text leaks and denial of service. Additional information can be found under...

[SECURITY] [DLA 1219-1] enigmail security update

Package : enigmail Version : 2:1.9.9-1deb7u1 CVE ID : CVE-2017-17843 CVE-2017-17844 CVE-2017-17845 CVE-2017-17846 CVE-2017-17847 CVE-2017-17848 Multiple vulnerabilities were discovered in Enigmail, an OpenPGP extension for Thunderbird, which could result in a loss of confidentiality, faked...

[SECURITY] [DSA 4070-1] enigmail security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4070-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 21, 2017 https://www.debian.org/security/faq -...

EulerOS 2.0 SP1 : gnutls (EulerOS-SA-2017-1203)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could...

EulerOS 2.0 SP2 : gnutls (EulerOS-SA-2017-1204)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could...

Debian DLA-1086-1 : enigmail security update

In DLA 1007-1 Thunderbird was upgraded to the latest ESR series. This update upgrades Enigmail, the OpenPGP extention for Thunderbird, to version 1.9.8.1 to restore full compatibility. For Debian 7 'Wheezy', these problems have been fixed in version 2:1.9.8.1-1deb7u1. We recommend that you upgrad...

Scientific Linux Security Update : gnutls on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: gnutls 3.3.26. Security Fixes : - A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially crafted certificate which,...

RedHat Update for gnutls RHSA-2017:2292-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : gnutls (RHSA-2017:2292)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2292 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as...

gnutls: Out of memory while parsing crafted OpenPGP certificate

The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service out-of-memory error and crash via a crafted OpenPGP certificate...

Moderate: Red Hat Security Advisory: gnutls security, bug fix, and enhancement update

An update for gnutls is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

gnutls: Stack overflow in cdk_pk_get_keyid

Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate...

Debian DSA-3921-1 : enigmail - security update

In DSA 3918 Thunderbird was upgraded to the latest ESR series. This update upgrades Enigmail, the OpenPGP extention for Thunderbird, to version 1.9.8.1 to restore full compatibility. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 3921-1] enigmail update

------------------------------------------------------------------------- Debian Security Advisory DSA-3921-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 28, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3921-1 (enigmail - security update)

In DSA 3918 Thunderbird was upgraded to the latest ESR series. This update upgrades Enigmail, the OpenPGP extention for Thunderbird, to version 1.9.8.1 to restore full compatibility. OpenVAS Vulnerability Test $Id: deb3921.nasl 6835 2017-08-02 12:55:28Z cfischer $ Auto-generated from advisory DSA...