Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions (CVE-2017-3735, CVE-2017-3736)

Summary Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions CVE-2017-3735, CVE-2017-3736 Vulnerability Details CVEID: CVE-2017-3735 Description: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error while parsing an...

Security Bulletin: eDiscovery Manager is affected by GSKit and GSKit-Crypto vulnerabilities

Summary eDiscovery Manager has addressed multiple GSKit and GSKit-Crypto vulnerabilities. Details of the vulnerabilities is mentioned below. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error when parsing DSA private...

Security update for bouncycastle (moderate)

This update for bouncycastle to version 1.59 fixes the following issues: These security issues were fixed: - CVE-2017-13098: BouncyCastle, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provided a weak Bleichenbacher oracle when any TLS cipher suite using...

DEBIAN-CVE-2017-5440

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.1,...

CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

UBUNTU-CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

Input validation

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

CVE-2016-1000340

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed org.bouncycastle.math.raw.Nat???. These classes are used by our custom elliptic curve implementations...

CVE-2016-1000340

The CVE-2016-1000340 issue describes a carry propagation bug in the Bouncy Castle JCE Provider (versions 1.51–1.55) affecting the squaring path of several Nat-based raw math classes used by custom EC implementations. This could cause rare, spurious calculations during elliptic-curve scalar multip...

PT-2018-4634 · Bouncy Castle +1 · Bouncy Castle Jce Provider +1

Name of the Vulnerable Software and Affected Versions: Bouncy Castle JCE Provider versions 1.51 through 1.55 Description: A carry propagation bug was introduced in the implementation of squaring for several raw math classes, which are used by custom elliptic curve implementations. This bug could...

New Facebook-Spread Malware Triggers Credential Theft, Cryptomining

A new malware campaign rapidly spreading via Facebook is infecting victims’ systems to steal their social media credentials and download cryptomining code. The malware, dubbed Nigelthorn by the Radware researchers who first discovered it, is being propagated via socially engineered links on...

openssl security update

1.0.2k-12.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-12 - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus 1.0.2k-11 - fix deadlock in RNG in the FIPS mode in mariadb...

openssl security and bug fix update

1.0.2k-12.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-12 - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus 1.0.2k-11 - fix deadlock in RNG in the FIPS mode in mariadb...

openssl: bn_sqrx8x_internal carry bug on x86_64

There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely...

SUSE-RU-2018:0821-1 Recommended update for drbd, drbd-utils

This update for drbd and drbd-utils provides the following fixes: Changes in drbd-utils: - Make sure the full bitmap gets properly propagated in drbdmeta. Also make sure the ID is kept when downgrading from v9 to v8. bsc1037109 - Support passing '--force' to drbdadm dump-md. bsc1077176 - Fix a...

Data Center Security Testing Tool: Infection Monkey

The Infection Monkey is an open source security tool for testing a data center’s resiliency to perimeter breaches and internal server infection. The Monkey uses various methods to self propagate across a data center and reports success to a centralized Command and ControlC&C server. The Infection...

Error: "Propagation failed on one or more servers" when you attempt to propagate changes to StoreFront Server Group

Consider the following scenario. You have two or more StoreFront servers in the Server Group. When you attempt to propagatechanges to the StoreFront Server Group, it might fail with the error: "Propagation failed on one or more servers " as shown in the screenshot below: Additionally, following...

Olympic Destroyer Takes Aim At Winter Olympics

This blog post is authored by Warren Mercer and Paul Rascagneres. Ben Baker and Matthew Molyett contributed to this post. Update 2/13 08:30 We have updated the information regarding the use of stolen credentials Update 2/12 12:00: We have updated the destructor section with action taken against...