Information disclosure

Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table PHT, aka BranchScope...

CVE-2018-9056

Systems with microprocessors utilizing speculative execution may allow unauthorized disclosure of information to an attacker with local user access via a side-channel attack on the directional branch predictor, as demonstrated by a pattern history table PHT, aka BranchScope...

CVE-2018-9056

CVE-2018-9056 (BranchScope) describes a side-channel vulnerability affecting processors using speculative execution, enabling local attackers to infer memory contents through the Branch Prediction Unit’s patterns, notably the Pattern History Table (PHT). Documents consistently reference a hardwar...

Information disclosure

Edger8r tool in the Intel SGX SDK before version 2.1.2 Linux and 1.9.6 Windows may generate code that is susceptible to a side channel potentially allowing a local user to access unauthorized information...

CVE-2014-4024

SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer SSL accelerator cards, might allow remote attackers to have...

CVE-2014-4024

Summary (CVE-2014-4024) : The vulnerability affects F5 BIG-IP SSL virtual servers when used with third-party SSL accelerator cards. A timing side-channel could allow remote attackers to observe activity with potential impact, under very specific conditions on local networks. Affected product fami...

USN-3561-1 libvirt update

It was discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. An attacker in the guest could use this to expose sensitive guest information, including kernel memory. This...

Debian: Security Advisory (DLA-1125-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for MozillaFirefox (important)

This update for MozillaFirefox fixes the following issues: - update to Firefox 52.6esr boo1077291 MFSA 2018-01 Speculative execution side-channel attack "Spectre" MFSA 2018-03 CVE-2018-5091 bmo1423086 Use-after-free with DTMF timers CVE-2018-5095 bmo1418447 Integer overflow in Skia library during...

USN-3540-1 linux, linux-aws, linux-euclid vulnerabilities

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. This update provide...

OracleVM 3.4 : microcode_ctl (OVMSA-2018-0011) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : - Enable early microcode load to allow updating Broadwell model 79 - Make sure 'modprobe microcode' is not executed on Broadwell model 79 - Run dracut upon microcode update - Add updated Intel 20180108...

Fedora 27 : botan (2017-523f6a613d)

Version 1.10.17, 2017-10-02 - Address a side channel affecting modular exponentiation. An attacker capable of a local or cross-VM cache analysis attack may be able to recover bits of secret exponents as used in RSA, DH, etc. CVE-2017-14737 - Workaround a miscompilation bug in GCC 7 on x86-32...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3530-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3530-1 advisory. It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that this could be...

Ubuntu: Security Advisory (USN-3530-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important kernel security update: Fixes for Meltdown and Spectre exploits; new kernel 3.10.0-693.11.6.vz7.40.4, Virtuozzo 7.0 Update 6 Hotfix 3 (7.0.6-710)

This update provides a new Virtuozzo 7.0 kernel 3.10.0-693.11.6.vz7.40.4 that is a rebase to the Red Hat Enterprise Linux 7 kernel 3.10.0-693.11.6.el7. The rebase fixes an industry-wide issue that was found in the way many modern microprocessor designs have implemented speculative execution of...

FreeBSD : mozilla -- Speculative execution side-channel attack (8429711b-76ca-474e-94a0-6b980f1e2d47)

Mozilla Foundation reports : Jann Horn of Google Project Zero Security reported that speculative execution performed by modern CPUs could leak information through a timing side-channel attack. Microsoft Vulnerability Research extended this attack to browser JavaScript engines and demonstrated tha...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3516-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3516-1 advisory. It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that...

Mozilla Firefox < 57.0.4 Speculative Execution Side-Channel Attack Vulnerability (Spectre)

The version of Mozilla Firefox installed on the remote Windows host is prior to 57.0.4. It is, therefore, vulnerable to a speculative execution side-channel attack. Code from a malicious web page could read data from other web sites or private data from the browser itself. C Tenable Network...

Ubuntu: Security Advisory (USN-3516-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2018:0010-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory bnc1068032. - CVE-2017-5753 / 'SpectreAttack': Local attackers...