PT-2017-16764

Name of the Vulnerable Software and Affected Versions ARM processors affected versions not specified Description The issue allows data and code pointers from JavaScript to be leaked, breaking Address Space Layout Randomization ASLR, by exploiting a side-channel attack on Memory Management Unit MM...

CVE-2017-5925: Exposure of Sensitive Information to an Unauthorized Actor

Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR...

PT-2017-16762

Name of the Vulnerable Software and Affected Versions Intel processors affected versions not specified Description The issue allows data and code pointers from JavaScript to be leaked, breaking Address Space Layout Randomization ASLR, by conducting a side-channel attack on Memory Management Unit...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2017-797)

It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. This issue was...

RedHat Update for java-1.7.0-openjdk RHSA-2017:0269-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Side-channel Timing Attack

OpenSSL is vulnerable to side-channel timing attacks. These attacks are possible because the Montgomery ladder implementation doesn't run swap operations in constant time which makes it easier for local users to obtain ECDSA nonce values...

Ubuntu: Security Advisory (USN-3193-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3782-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : Nettle vulnerability (USN-3193-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3193-1 advisory. It was discovered that Nettle incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover...

USN-3193-1 nettle vulnerability

It was discovered that Nettle incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys...

USN-3193-1: Nettle vulnerability

It was discovered that Nettle incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys...

Side Channel Attack On Modular Exponentiation

OpenSSL is vulnerable to side channel attacks. The vulnerability exploits cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, exposing RSA keys. However, an attacker can only exploit this only if he has control of code in a thread running on the same hyper-threaded core as the victi...

java security update

CentOS Errata and Security Advisory CESA-2017:0180 An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS ba...

OpenJDK: DSA implementation timing attack (Libraries, 8168728)

A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...

Side Channel Leakage

bouncycastle is vulnerable to side channel leakages. The library uses large static lookup tables in AESFastEngine mode, meaning where data accessed by the CPU can be observed, it is possible for a malicious user to gain information about the key used to initialize the cipher...

GLSA-201701-23 : Botan: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201701-23 Botan: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Botan. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might obtain ECDSA secret keys via a timi...

Botan: Multiple vulnerabilities

Background Botan Japanese for peony is a cryptography library written in C++11. Description Multiple vulnerabilities have been discovered in Botan. Please review the CVE identifiers referenced below for details. Impact A remote attacker might obtain ECDSA secret keys via a timing side-channel...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used thanks to Pa...

Ubuntu: Security Advisory (USN-3163-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerabilities (USN-3163-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3163-1 advisory. It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause N...