Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fixes: Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6856 Mozilla: Memory safety bugs fixed in Firefox 121, Firefo...

ALSA-2024:0001 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fixes: Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6856 Mozilla: Memory safety bugs fixed in Firefox 121, Firefo...

NewStart CGSL MAIN 6.06 : libgcrypt Vulnerability (NS-SA-2023-0085)

The remote NewStart CGSL host, running version MAIN 6.06, has libgcrypt packages installed that are affected by a vulnerability: - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous...

PT-2023-7922 · Mozilla +9 · Thunderbird +9

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 115.6 Description: The issue is related to errors in handling OpenPGP cryptographic signatures. Exploitation of this issue may allow a remote attacker to perform a spoofing attack. When processing a PGP/MIME...

[SECURITY] Fedora 38 Update: rust-sequoia-wot-0.5.0-4.fc38

An implementation of OpenPGP's web of trust...

[SECURITY] Fedora 39 Update: rust-sequoia-wot-0.5.0-4.fc39

An implementation of OpenPGP's web of trust...

Fedora: Security Advisory for rust-sequoia-wot (FEDORA-2023-6215ea423b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for rust-sequoia-wot (FEDORA-2023-9790b327cb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: gnutls-3.8.2-1.fc39

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

opensc security update

0.23.0-2 - Fix regression in handling OpenPGP cards - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos 0.23.0-1 - Rebase to latest 0.23.0 release 2100409 - Use separate OpenSSL context to work better from inside of OpenSSL providers...

Rocky Linux 8 : rpm (RLSA-2022:0368)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0368 advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check the binding...

Oracle Linux 8 : evolution (ELSA-2020-1600)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1600 advisory. - Update patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar - Add patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar Tenable has...

Oracle Linux 7 : evolution (ELSA-2020-1080)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1080 advisory. - Update patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar - Add patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar - Ad...

PGP Signature Spoofing

openpgp is vulnerable to PGP Signature Spoofing. The vulnerability exists due to ignoring text before the hash: ... section. An attacker can append text to the start of of the line, which will appear as signed but the library ignores verifying it...

@blackdark/hashicorp-js-releases (=1.4.7), @cythral/renovate (>=0.1.6 <=0.1.7) +6 more potentially affected by CVE-2023-41037 via openpgp (>=5.0.0 <=5.0.1)

openpgp NPM version =5.0.0, =0.1.6, =1.1.15, =1.1.46, =1.32.0, =27.31.10, =1.35.0, =1.29.0, =1.30.0 Source cves: CVE-2023-41037 Source advisory: OSV:GHSA-CH3C-V47X-4PGP...

Cleartext Signed Message Signature Spoofing in openpgp

Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...

@emiliogonzalezpe/comp (>=1.6.0 <=1.6.1), @monax/hoard (>=9.0.0-dev.5644f38 <=9.1.0) +80 more potentially affected by CVE-2023-41037 via openpgp (>=0.11.1 <=4.10.10)

openpgp NPM version =0.11.1, =1.6.0, =9.0.0-dev.5644f38, =1.0.1, =0.0.1, =1.6.0, =1.4.0, =1.6.0, =0.0.0-semantic-release, =0.4.2, =0.0.1, =0.1.0, =0.3.0 and more Source cves: CVE-2023-41037 Source advisory: OSV:GHSA-CH3C-V47X-4PGP...

GHSA-CH3C-V47X-4PGP Cleartext Signed Message Signature Spoofing in openpgp

Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...

Design/Logic Flaw

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...