SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2021:3217-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3217-1 advisory. The SUSE Linux Enterprise 12 SP5 Realtime kernel was updated to receive various security and bugfixes. The following security bugs were fixed: ...

Security Bulletin: Power Hardware Management Console is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Problem Security vulnerabilities have been discovered in OpenSSL. Resolving The Problem Vulnerability Details CVE-ID: CVE-2014-0160 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the TLS/DTLS heartbeat functionality. An attacker could...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:3205-1 Rating: important References: 1040364 1127650 1135481 1152489 1160010 1168202 1171420 1174969 1175052 1175543 1177399 1180100 1180141 1180347 1181006 1181148 1181972 1184180 1185902 1186264...

Ubuntu 16.04 ESM : Libgcrypt vulnerabilities (USN-5080-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5080-2 advisory. USN-5080-1 fixed several vulnerabilities in Libgcrypt. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the...

chromium -- multiple vulnerabilities

Chrome Releases reports: This update contains 19 security fixes, including: 1243117 High CVE-2021-37956: Use after free in Offline use. Reported by Huyna at Viettel Cyber Security on 2021-08-24 1242269 High CVE-2021-37957: Use after free in WebGPU. Reported by Looben Yang on 2021-08-23 1223290 Hi...

Security update for the Linux Kernel (important)

openSUSE Security Update: Security update for the Linux Kernel Announcement ID: openSUSE-SU-2021:3179-1 Rating: important References: 1040364 1127650 1135481 1152489 1160010 1168202 1171420 1174969 1175052 1175543 1177399 1180100 1180141 1180347 1181006 1181148 1181972 1184180 1185902 1186264...

Ubuntu 18.04 LTS / 20.04 LTS : Libgcrypt vulnerabilities (USN-5080-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5080-1 advisory. It was discovered that Libgcrypt incorrectly handled ElGamal encryption. An attacker could possibly use this issue to recover sensitive...

EulerOS 2.0 SP2 : libgcrypt (EulerOS-SA-2021-2395)

According to the version of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack...

New SpookJS Attack Bypasses Google Chrome's Site Isolation Protection

A newly discovered side-channel attack demonstrated on modern processors can be weaponized to successfully overcome Site Isolation protections weaved into Google Chrome and Chromium browsers and leak sensitive data in a Spectre-style speculative execution attack. Dubbed "Spook.js" by academics fr...

openSUSE 15 Security Update : spectre-meltdown-checker (openSUSE-SU-2021:1212-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1212-1 advisory. - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker...

hw: Fast forward store predictor

A flaw was found in the CPU microarchitecture where a local attacker is able to abuse a timing issue which may allow them to infer internal architectural state from previous executions on the CPU...

openSUSE 15 Security Update : spectre-meltdown-checker (openSUSE-SU-2021:2861-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:2861-1 advisory. - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker...

GHSA-7CQG-8449-RMFV Observable Discrepancy in libsecp256k1-rs

A timing vulnerability in the Scalar::checkoverflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack...

Observable Discrepancy in libsecp256k1-rs

A timing vulnerability in the Scalar::checkoverflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack...

libsecp256k1 contains side-channel timing attack

Versions of libsecp256k1 prior to 0.3.1 did not execute Scalar::checkoverflow in constant time. This allows an attacker to potentially leak information via a timing attack. The flaw was corrected by modifying Scalar::checkoverflow to execute in constant time...

hw: L1D Cache Eviction Sampling

A microarchitectural timing flaw was found on some Intel processors. A corner case exists where data in-flight during the eviction process can end up in the “fill buffers” and not properly cleared by the MDS mitigations. The fill buffer contents which were expected to be blank can be inferred usi...

Information Disclosure

amd64-microcode:stretch is vulnerable to information disclosure. Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis...

Nuvoton TPM 2.0 ECDSA Vulnerability - Lenovo Support US

No description provided...

CVE-2020-25082

An attacker with physical access to Nuvoton Trusted Platform Module NPCT75x 7.2.x before 7.2.2.0 could extract an Elliptic Curve Cryptography ECC private key via a side-channel attack against ECDSA, because of an Observable Timing Discrepancy...

CVE-2020-25082

An attacker with physical access to Nuvoton Trusted Platform Module NPCT75x 7.2.x before 7.2.2.0 could extract an Elliptic Curve Cryptography ECC private key via a side-channel attack against ECDSA, because of an Observable Timing Discrepancy...