CVE-2020-6616

CVE-2020-6616 involves Broadcom BCM4361 Bluetooth RNG: a low-entropy PRNG is used where a Hardware RNG should be, enabling spoofing risks. Publicly documented impact references include Apple’s iOS 13.5/iPadOS 13.5 notes, which list CVE-2020-6616 under Bluetooth with a low-entropy PRNG issue, affe...

PT-2020-19183 · Broadcom +1 · Broadcom Chips +3

Name of the Vulnerable Software and Affected Versions: Broadcom chips affected versions not specified Samsung Galaxy S8, S8+, and Note8 devices with the BCM4361 chipset Description: The issue arises from the use of a low-entropy Pseudo Random Number Generator PRNG in situations where a Hardware...

UBUNTU-CVE-2020-11035

In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6...

Insecure Random Number Generator

github.com/elastic/cloud-on-k8s uses an insecure random number generator. Passwords are generated using an insecure random number generator, which would allow an attacker to easily brute-force and discover the Elasticsearch credentials generated by ECK...

gcc: POWER9 "DARN" RNG intrinsic produces repeated output

The POWER9 backend in GNU Compiler Collection GCC before version 10 could optimize multiple calls of the builtindarn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single...

openssl: information disclosure in fork()

OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...

Insecure Randomness

php is vulnerable to insecure randomness. The vulnerability as it was discovered that the PHP lcgvalue function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to genera...

Weak Random Number Generator

php is vulnerable to weak random number generator. The vulnerability exists as it was discovered that PHP did not properly seed its pseudo-random number generator used by functions such as rand and mtrand, possibly allowing an attacker to easily predict the generated pseudo-random values...

Weak Random Number Generator

php is vulnerable to weak random number generator. The vulnerability exists as it was discovered that PHP did not properly seed its pseudo-random number generator used by functions such as rand and mtrand, possibly allowing an attacker to easily predict the generated pseudo-random values...

Weak Encryption

kernel is vulnerable to weak encryption. The vulnerability exists due to a lack of random number generation, which allowed a local user to cause a denial of service or potentially gain privileges...

Information Disclosure

kernel is vulnerable to information disclosure. The vulnerability exists as a bug in the random number generator that prevented the manual seeding of the entropy pool...

openssl: information disclosure in fork()

OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...

openssl: information disclosure in fork()

OpenSSL 1.1.1 introduced a rewritten random number generator RNG. This was intended to include protection in the event of a fork system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A...

EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1367)

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - qemu-kvm is an open source virtualizer that provides hardware emulation for the KVM hypervisor. qemu-kvm acts as a...

SUSE-SU-2020:0818-1 Security update for cloud-init

This update for cloud-init fixes the following security issues: - CVE-2020-8631: Replaced the theoretically predictable deterministic random number generator with the system RNG bsc1162937. - CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936...

CVE-2020-10560

An issue was discovered in Open Source Social Network OSSN through 5.3. A user-controlled file path with a weak cryptographic rand can be used to read any file with the permissions of the webserver. This can lead to further compromise. The attacker must conduct a brute-force attack against the...

OPENSUSE-SU-2020:0400-1 Security update for cloud-init

This update for cloud-init fixes the following security issues: - CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. - CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. This update was imported from the...

Insecure Random Number Generator

gcc uses an insecure random number generator. The POWER9 "DARN" RNG intrinsic produces repeated output...

gcc: POWER9 "DARN" RNG intrinsic produces repeated output

The POWER9 backend in GNU Compiler Collection GCC before version 10 could optimize multiple calls of the builtindarn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single...

[SECURITY] Fedora 31 Update: nethack-3.6.6-1.fc31

NetHack is a single player dungeon exploration game that runs on a wide variety of computer systems, with a variety of graphical and text interfaces all using the same game engine. Unlike many other Dungeons & Dragons-inspired games, the emphasis in NetHack is on discovering the detail of the...