CVE-2017-8932

A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could possibly use this flaw to extract private keys when static ECDH was used...

Mozilla: Use-after-free in txExecutionState destructor during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1,...

Chrome Universal XSS using exceptions thrown from Object.observe (CVE-2015-1304)

VULNERABILITY DETAILS From /v8/src/object-observe.js: function ObjectObserveobject, callback, acceptList ... var objectObserveFn = %GetObjectContextObjectObserveobject; return objectObserveFnobject, callback, acceptList; From /v8/src/runtime/runtime-observe.cc:...

Mozilla: Use-after-free in txExecutionState destructor during XSLT processing (MFSA 2017-11, MFSA 2017-12)

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1,...

MySQL 5.6.x < 5.6.36 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU) (Riddle)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but...

Information Disclosure

OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug during the montgomery squaring procedure. This makes it easier for a malicious user to obtain sensitive private key information from the Diffie-Hellman Ciphersuite as the attack can be conducted offline...

Information Disclosure

OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug that can allow a malicious user to gain information on the curve used for encryption during key negotiation using the Elliptic Curve Diffie-Hellman EC-DH Cipher...

Updated openssl packages fix security vulnerability

There is a carry propagation bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. mong EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation CVE-2016-7055. If an...

Carry Propagation

bouncycastle is vulnerable to carry propagation bugs. This bug caused mathematical miscalculations during static Elliptic Curve Diffie Hellman which in rare cases for it to miscalculate elliptic curve scalar multiplication. This allows a malicious user in certain cases to obtain the key...

Windows 10: protection, detection, and response against recent Depriz malware attacks

A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender...

CVE-2016-7055

There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is...

kernel: Slave being first propagated copy causes oops in propagate_mnt

fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service NULL pointer dereference and OOPS via a crafted series of mount system calls...

nettle: secp256 calculation bug

The ecc256modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

nettle: secp256 calculation bug

The ecc256modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

kernel: Slave being first propagated copy causes oops in propagate_mnt

fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service NULL pointer dereference and OOPS via a crafted series of mount system calls...

CVE-2016-5406

The domain controller in Red Hat JBoss Enterprise Application Platform EAP 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller will not propagate its administrative RBAC configuration to some slaves. An attacker could use this to escalate their privileges...

Unable to propagate the changes and the configuration replication service crashes at the server.

Under certain circumstances, StoreFront may be unable to propagate the changes between servers and the configuration replication service may experience a crash...

Wechat discovered arbitrary code execution vulnerability 3 6 0 mobile Guard provides a self-test programme-vulnerability warning-the black bar safety net

Recently, the 3 6 0 mobile Guard Alpha team-Alpha Team exclusive found wechat remote arbitrary code execution vulnerability, which was named badkernel it. 3 6 0 mobile Guard Alpha team found, through this vulnerability an attacker may access the micro-channel full control, compromise the user's...