Fedora 23 : botan (2016-f2aae0dbc5)

From the upstream release notes : Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures CVE-2016-2849 and PKCS 1 RSA decryption CVE-2015-7827. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Updated mbedtls packages fix security vulnerabilities

Updated mbedtls packages fix security vulnerabilities: The mbedtls package has been updated to version 1.3.17, which fixes a few minor security issues in mbedtlsrsarsaespkcs1v15encrypt and mbedtlsrsarsaesoaepencrypt and fixes a handful of other bugs as well. See the upstream release announcement...

sslv2-drown NSE Script

Determines whether the server supports SSLv2, what ciphers it supports and tests for CVE-2015-3197, CVE-2016-0703 and CVE-2016-0800 DROWN Script Arguments tls.servername See the documentation for the tls library. smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername See the...

The vulnerability of Thunderbird software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library of Mozilla, applicable to Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla SeaMonkey, Google Chrome, and Google Chrome OS. It stems from improper handling of ASN.1 values in X.509 certificates. Exploiting this...

Design/Logic Flaw

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

CVE-2016-0899

CVE-2016-0899 affects EMC RSA Archer GRC 5.5.x before 5.5.3.4. Affects web application where remote authenticated users can read the web.config.bak file by altering IIS to set a Content-Type header for .bak files, enabling access to sensitive credential information. Root cause: improper handling ...

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

Install or Upgrade of Veeam Backup & Replication fails with “Error occurred during certificate processing.”

Challenge When attempting to install or upgrade Veeam Backup & Replication, the "Installing Veeam Backup & Replication Server" step fails with: Error occurred during certificate processing. Cause This error occurs when the RSA private key generation fails during Veeam Backup & Replication...

EMC RSA Archer eGRC Information Disclosure Vulnerability

EMC RSA Archer eGRC is an enterprise IT governance and compliance governance product from EMC Corporation EMC. The product can be used to manage enterprise risk, automate business processes, and more. A security vulnerability exists in the EMC RSA Archer eGRC 5.5.x release. A remote attacker can...

FreeBSD : botan -- multiple vulnerabilities (ac0900df-31d0-11e6-8e82-002590263bf5)

Jack Lloyd reports : Botan 1.10.13 has been released backporting some side channel protections for ECDSA signatures CVE-2016-2849 and PKCS 1 RSA decryption CVE-2015-7827. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

MGASA-2016-0208 Updated botan packages fix security vulnerabilities

Updated botan packages fix security vulnerabilities: During RSA decryption, how long decoding of PKCS 1 v1.5 padding took was input dependent. If these differences could be measured by an attacker, it could be used to mount a Bleichenbacher million-message attack CVE-2015-7827. ECDSA and DSA...

Updated botan packages fix security vulnerabilities

Updated botan packages fix security vulnerabilities: During RSA decryption, how long decoding of PKCS 1 v1.5 padding took was input dependent. If these differences could be measured by an attacker, it could be used to mount a Bleichenbacher million-message attack CVE-2015-7827. ECDSA and DSA...

TOR Mail Encrypted Server: OnionMail

TOR Mail Encrypted Server for Hidden Services OnionMail is an anonymous, encrypted mail server made to run on TOR network without losing the ability to communicate with the Internet. All OnionMail servers are configured as TOR hidden services and use SSL via STARTTLS. To use OnionMail all you nee...

openSUSE Security Update : proftpd (openSUSE-2016-603)

This proftpd update to version 1.3.5b fixes the following issues : Security issues fixed : - CVE-2016-3125: Fixed selection of DH groups from TLSDHParamFile. boo970890 Bugs fixed : - update to 1.3.5b: http://www.proftpd.org/docs/RELEASENOTES-1.3.5b - SSH RSA hostkeys smaller than 2048 bits now wo...

Fortinet FortiGate RSA-CRT Key Leak Vulnerability (FG-IR-16-008)

FortiOS now includes for all SSL libraries a countermeasure against Lenstra SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

RSA-CRT key leak under certain conditions

FortiOS now includes for all SSL libraries a countermeasure against Lenstra's fault attack on RSA-CRT optimization when a RSA signature is corrupted...

EMC RSA Authentication Manager < 8.1 SP1 Patch 14 Multiple Vulnerabilities

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.1 SP1 Patch 14. It is, therefore, affected by multiple vulnerabilities : - Multiple cross-site scripting vulnerabilities exist due to a failure to properly validate input before returning it to users. An...

openSUSE Security Update : Firefox 46.0 (openSUSE-2016-566) (SWEET32)

This update to Mozilla Firefox 46.0 fixes several security issues and bugs boo977333. The following vulnerabilities were fixed : - CVE-2016-2804: Miscellaneous memory safety hazards - MFSA 2016-39 boo977373 - CVE-2016-2806: Miscellaneous memory safety hazards - MFSA 2016-39 boo977375 -...

Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability

A vulnerability in the SSH version 2 SSHv2 protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. Successful exploitation could allow the attacker to log in with the privileges of the user or the privileges configure...