Debian DSA-3024-1 : gnupg - security update

Genkin, Pipman and Tromer discovered a side-channel attack on Elgamal encryption subkeys CVE-2014-5270 . In addition, this update hardens GnuPG's behaviour when treating keyserver responses; GnuPG now filters keyserver responses to only accepts those keyid's actually requested by the user...

DLA-54-1 gnupg - security-update

Bulletin has no description...

Mandriva Linux Security Advisory : libgcrypt (MDVSA-2014:176)

Updated libgcrypt packages fix security vulnerability : The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandriv...

[SECURITY] [DSA 3024-1] gnupg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3024-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 11, 2014 http://www.debian.org/security/faq -...

freeshell fix side-channel attack vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability science Side-channel attacksside channel attack referred to as SCA, also known as side-channel attacks:for the encryption of electronic devices during the run time consumption, power consumption or electromagnetic radiation or the like of the side-channel information leakage and...

DSA-3024-1 gnupg - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3024-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2014-0365 Updated libgcrypt packages fix CVE-2014-5270

Updated libgcrypt packages fix security vulnerability: The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270...

Updated libgcrypt packages fix CVE-2014-5270

Updated libgcrypt packages fix security vulnerability: The libgcrypt library before version 1.5.4 is vulnerable to an ELGAMAL side-channel attack CVE-2014-5270...

SuSE 11.3 Security Update : libgcrypt (SAT Patch Number 9646)

This libgcrypt update fixes the following security issue : - Side-channel attack on Elgamal encryption subkeys. CVE-2014-5270. bnc892464 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The...

GLSA-201408-10 : Libgcrypt: Side-channel attack

The remote host is affected by the vulnerability described in GLSA-201408-10 Libgcrypt: Side-channel attack A vulnerability in the implementation of ElGamal decryption procedures of Libgcrypt leaks information to various side-channels. Impact : A physical side-channel attack allows a remote...

Stealing Encryption Keys Just by Touching a Laptop

As far sci-fi movies have been entertaining the public, but their ideas have always been a matter of adoption in real life. Just like in any other sci-fi movie, simply touching a laptop can be enough to extract the cryptographic keys used to secure data stored on it. A team of computer security...

Android Side-Channel Hack Leads to Data Loss at USENIX

A weakness in Android, one that’s likely also found in other leading operating systems, allows an attacker to infer what’s happening on a victim’s user interface and launch an appropriate secondary attack resulting in data loss. Researchers from the University of Michigan and the University of...

openSUSE Security Update : libgcrypt (openSUSE-SU-2014:1058-1)

libgcrypt was updated to 1.5.4 to prevent a side-channel attack on Elgamal encryption subkeys. Besides that the following issues were resolved : - Improved performance of RSA, DSA, and Elgamal by using a new exponentiation algorithm. - Fixed a subtle bug in mpisetbit which could set spurious bits...

CVE-2014-5204

wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...

CVE-2014-5204: Cross-Site Request Forgery (CSRF)

wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...

CVE-2014-0852

The CVE affects IBM WebSphere DataPower SOA Appliances. Affected versions include 4.0.2.15, 5.x up to 5.0.0.17, 6.0.0.x up to 6.0.0.9, and 6.0.1.x up to 6.0.1.5. Root cause: a SSL/TLS side-channel timing vulnerability that can reveal the PreMasterSecret when an attacker on the same LAN sends mill...

PT-2014-3893

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower SOA appliances versions 4.0.2.15 and earlier IBM WebSphere DataPower SOA appliances versions 5.x through 5.0.0.17 IBM WebSphere DataPower SOA appliances versions 6.0.0.x through 6.0.0.9 IBM WebSphere DataPower SOA...

CVE-2014-0852: Undefined Security Weakness

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

PT-2014-5368

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions prior to 2013.2.4 OpenStack Compute Nova versions 2014.x prior to 2014.1.2 OpenStack Compute Nova Juno versions prior to Juno-2 Description The issue makes it easier for remote attackers to guess instance ID...