Code injection

In Snapdragon Automobile, Mobile, Wear in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD...

CVE-2018-5837

The CVE-2018-5837 entry concerns Snapdragon SoCs (IPQ8074, MDM9xxx, SD series, etc.) where MAC address randomization during probe requests is compromised by a flawed RNG that outputs repeating values far sooner than expected. The description covers the affected devices and the root cause, but the...

CVE-2018-11291

In Snapdragon Automobile, Mobile, Wear in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD...

CVE-2018-11291

CVE-2018-11291 affects Qualcomm Snapdragon and related IPs (e.g., IPQ8074, MDM9xxx, QCA family, SD/MOD platforms) with a cryptographic RNG that is not strong enough. The issue is described in the CVE as cryptographic issues due to weak randomness in NAN, affecting listed Snapdragon/SoC families. ...

Design/Logic Flaw

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS both classic and Artery Remoting. Akka allows configuration of custom random number generators. For historical reasons, Akka included t...

Attack on Pseudo-random number generator (PRNG) used in 1000 Guess, an Ethereum lottery game. (CVE-2018–12454)

Abstract An Ethereum lottery game, 1000 Guess, has a vulnerability that it generates random numbers predictable by anyone. This game decides a winner by a random number when the number of players who bet on the contract reaches to the predetermined number. The contract generates the random number...

Micali-Schnorr Generator (MS-DRBG) Part III - Zero Knowledge Proof Wanted!!

See also Part I and Part II of this series This is going to be a short blog post about the infamous Micali-Schnorr Random Number Generator MS-DRBG. See Part I and Part II of this series for more information about this topic. WHO: NIST published the specification for Micali-Schnorr Random Number...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on the upstream 4.14.44 and fixes at least the following security issues: The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial...

The vulnerability of the mechanism for handling errors during the establishment of SSL connections for Qualcomm’s Android operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the error handling mechanism for establishing SSL connections in Qualcomm’s Android operating system is related to improper error handling of errors returned by the RNG function. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality,...

CenoCipher - Easy-To-Use, End-To-End Crypto-Communication Tool

CenoCipher is a free, open-source, easy-to-use tool for exchanging secure encrypted communications over the internet. It uses strong cryptography to convert messages and files into encrypted cipher-data, which can then be sent to the recipient via regular email or any other channel available, suc...

IBM Worklight and Mobile Foundation Weak Password Vulnerability

IBM Worklight and Mobile Foundation are both products of IBM Corporation in the U.S. IBM Worklight is a suite of integrated development environments IDEs for developing, testing, running, and managing mobile applications.Mobile Foundation is a suite of software for rapidly creating mobile and...

kernel: Null pointer dereference in rngapi_reset function

A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...

kernel: Null pointer dereference in rngapi_reset function

A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...

CVE-2018-9057

aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...

OracleVM 3.3 : dhcp (OVMSA-2018-0024)

The remote OracleVM system is missing necessary patches to address critical security updates : - Added oracle-errwarn-message.patch - Resolves: 1550085 - CVE-2018-5733 Avoid reference overflow 12:4.1.1-53.P1.2 - Resolves: 1550083 - CVE-2018-5732 Avoid options buffer overflow - Resolves: 1063217 -...

Insecure Number Generator

github.com/markbates/goth is vulnerable to insecure number generator. The SetState function in gothic.go uses math/rand which is a weak random number generator and not robust enough to withstand a cryptographic attack against it...

Encryption 101: ShiOne ransomware case study

In part one of this series, Encryption 101: a malware analyst's primer, we introduced some of the basic encryption concepts used in malware. If you haven't read it, we suggest going back for a review, as it's necessary in order to be able to fully follow part two, our case study. In this study, w...

CVE-2017-15116

A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...

SMA Solar Technology inverter access control error vulnerability (CNVD-2017-27841)

SMA Solar Technology inverter is a photovoltaic inverter device from SMA Germany. An access control error vulnerability exists in the SMA Solar Technology inverter. An attacker could use this vulnerability to change the system time, affecting the timestamp-based locking policy and the random numb...

For NXP I. MX microprocessor HAB vulnerability analysis-vulnerability warning-the black bar safety net

One, Foreword NXP（NXP）semiconductor production company i. The MX Series application processor of the Secure Boot features in the presence of two vulnerabilities, two vulnerabilities by Quarkslab the two researchers Guillaume Delugré and Kévin Szkudłapski found this article on the two vulnerabilit...