SUSE-SU-2018:0007-1 Security update for qemu

This update for qemu fixes the following issues: A new feature was added: - Support EPYC vCPU type bsc1052825 fate324038 Also a mitigation for a security problem has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to...

SUSE-SU-2018:0008-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: - Add microcodeamdfam17h.bin bsc1068032 CVE-2017-5715 This new firmware disables branch prediction on AMD family 17h processor to mitigate a attack on the branch predictor that could lead to information disclosure from e.g. kernel memory...

CVE-2017-5754

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache...

UBUNTU-CVE-2017-5715

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...

CVE-2017-5715

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...

PT-2018-1001

Name of the Vulnerable Software and Affected Versions Systems with microprocessors utilizing speculative execution and branch prediction affected versions not specified Description The issue is related to microprocessors utilizing speculative execution and branch prediction, which may allow...

CVE-2017-5214

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files...

CVE-2017-5214

The Codextrous B2J Contact aka b2jcontact extension before 2.1.13 for Joomla! allows prediction of a uniqid value based on knowledge of a time value. This makes it easier to read arbitrary uploaded files...

Insecure randomness

Overview Affected versions of socket.io depend on Math.random to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization. Recommendation Update to v0.9...

CVE-2016-5100

Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value...

CVE-2016-6887

The pstmexptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via a CRT attack...

CVE-2016-8671: Exposure of Sensitive Information to an Unauthorized Actor

The pstmexptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-6887...

PT-2017-9722

Name of the Vulnerable Software and Affected Versions MatrixSSL versions 3.8.6 and earlier Description The issue is related to the pstm exptmod function, which does not properly perform modular exponentiation. This could allow remote attackers to predict the secret key via unspecified vectors...

PT-2017-9049

Name of the Vulnerable Software and Affected Versions MatrixSSL versions 3.8.6 and earlier Description The issue concerns the pstm exptmod function, which does not properly perform modular exponentiation. This could allow remote attackers to predict the secret key via a CRT attack. Recommendation...

Gratipay: Gratipay uses the random module's cryptographically insecure PRNG.

Dear Gratipay bug bounty team, Summary --- Gratipay currently uses the random module's pseudo-random number generator which is not a cryptographically secure PRNG as stated in the docs: The pseudo-random generators of this module should not be used for security purposes. For security or...

GLSA-201612-01 : GnuPG: RNG output is predictable

The remote host is affected by the vulnerability described in GLSA-201612-01 GnuPG: RNG output is predictable A long standing bug since 1998 in Libgcrypt see GLSA 201610-04 below and GnuPG allows an attacker to predict the output from the standard RNG. Please review the Entropy Loss and Output...

CentOS Update for libgcrypt CESA-2016:2674 centos6

Check the version of libgcrypt SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882589";...

openSUSE Security Update : libgcrypt (openSUSE-2016-1138)

This update for libgcrypt fixes the following issues : - RNG prediction vulnerability bsc994157, CVE-2016-6313 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

SUSE-SU-2016:2345-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: - RNG prediction vulnerability bsc994157, CVE-2016-6313...

openSUSE Security Update : libgcrypt (openSUSE-2016-1042)

This update for libgcrypt fixes the following issues : - RNG prediction vulnerability boo994157, CVE-2016-6313 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2016-1042. The text...