Design/Logic Flaw

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating the Linux System V Application Binary Interface ABI for such operations, a host app can compromise the execution integrity of some x87 FPU operations in an...

CVE-2020-15107

CVE-2020-15107 affects OpenEnclave up to version 0.10.0: enclaves performing x87 FPU operations can be tampered by a malicious host app that violates the Linux SYSV ABI, compromising execution integrity and enabling potential side-channel attacks depending on FPU config. The issue has been fixed ...

CVE-2020-6531

Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page...

CVE-2020-6521

Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page...

kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure

A flaw was found in the way the Linux kernel implemented a software flush of the Count Cache indirect branch cache and Link Return Address Stack on the PowerPC platform. The flushing of these structures helps to prevent SpectreRSB like attacks which may leak information from one user process to...

Google Chrome Side Channel Information Leakage Vulnerability

Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. Autofill in versions prior to Google Chrome 84.0.4147.89 suffers from side-channel information leakage, and no details of the vulnerability are provided at this tim...

PT-2020-6862

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve...

Fedora 32 : botan2 (2020-539fd85292)

Update to 2.14.0 including security fix Side channel during CBC padding. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5755)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5755 advisory. - p54usb: Fix race between disconnect and firmware loading Alan Stern Orabug: 31351863 CVE-2019-15220 - media: rc: prevent memory leak in cx23888irprob...

chromium -- multiple vulnerabilities

Chrome Releases reports: This update contains 38 security fixes, including: 1103195 Critical CVE-2020-6510: Heap buffer overflow in background fetch. Reported by Leecraso and Guang Gong of 360 Alpha Lab working with 360 BugCloud on 2020-07-08 1074317 High CVE-2020-6511: Side-channel information...

openSUSE: Security Advisory for mozilla-nss (openSUSE-SU-2020:0953-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0955-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

OPENSUSE-SU-2020:0953-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

Security update for mozilla-nss (moderate)

openSUSE Security Update: Security update for mozilla-nss Announcement ID: openSUSE-SU-2020:0955-1 Rating: moderate References: 1168669 1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability and has one errata is now available...

Security update for mozilla-nss (moderate)

openSUSE Security Update: Security update for mozilla-nss Announcement ID: openSUSE-SU-2020:0953-1 Rating: moderate References: 1168669 1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

Updated mbedtls packages fix security vulnerability

Updated mbedtls packages fix security vulnerabilities Fix a side channel vulnerability in modular exponentiation that could reveal an RSA private key used in a secure enclave. Fix side channel in mbedtlsecpcheckpubpriv and mbedtlspkparsekey / mbedtlspkparsekeyfile when loading a private key that...

USN-4376-2: OpenSSL vulnerabilities

USN-4376-1 fixed several vulnerabilities in OpenSSL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered...

USN-4376-2 openssl vulnerabilities

USN-4376-1 fixed several vulnerabilities in OpenSSL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered...

CVE-2020-12402

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secr...

ALPINE-CVE-2020-12402

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secr...