CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

Code injection

In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack...

CVE-2016-8871

CVE-2016-8871 affects Botan 1.11.29 through 1.11.32, where RSA decryption with certain padding options exposes a detectable OAEP timing channel. With a sufficient number of queries, an attacker could recover plaintext. The provided connected documents confirm the vulnerability details but do not ...

Bypassing ASLR in 60 Milliseconds

Address Space Layout Randomization was a champion hardening technology introduced in most major desktop and mobile operating systems as a mitigation against memory-based code-execution attacks. Bypassing ASLR, however, has become somewhat of a parlor game for attackers and white-hat researchers,...

Intel Integrated Performance Primitives RSA Private Key Disclosure Vulnerability

Intel Integrated Performance Primitives IPP is a suite of programming tools for working with images, signal processing, and data from Intel Corporation.Cryptography is one of the encryption technologies.... A security vulnerability exists in Intel IPP Cryptography versions prior to 9.0.4. A local...

GLSA-201610-04 : libgcrypt: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201610-04 libgcrypt: Multiple vulnerabilities Multiple vulnerabilities have been discovered in libgcrypt. Please review the CVE identifiers referenced below for details. Impact : Side-channel attacks can leak private key...

CVE-2016-8100

Intel Integrated Performance Primitives aka IPP Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack...

CVE-2016-8100

Intel Integrated Performance Primitives aka IPP Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack...

Code injection

Intel Integrated Performance Primitives aka IPP Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack...

CVE-2016-8100

Intel Integrated Performance Primitives aka IPP Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack...

CVE-2016-8100

Intel IPP Cryptography before 9.0.4 is vulnerable to a local-side-channel attack that enables discovery of RSA private keys. Affected product: Intel IPP Cryptography (part of IPP) prior to version 9.0.4. Root cause: information leaked through a side channel allowing a local attacker to recover th...

libgcrypt: Multiple vulnerabilities

Background libgcrypt is a general purpose cryptographic library derived out of GnuPG. Description Multiple vulnerabilities have been discovered in libgcrypt. Please review the CVE identifiers referenced below for details. Impact Side-channel attacks can leak private key information. A separate...

A vulnerability in Intel Integrated Performance Primitives (IPP) Cryptography allows local users to recover the RSA private key via a potential side-channel.

Summary: The cryptography CP domain in Intel’s newest version of Intel® Integrated Performance Primitives Intel® IPP v2017 has been enhanced to improve its security and customers are strongly urged to update to this release. Description: A potential side-channel vulnerability was identified in th...

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016

On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,” one as “Moderate Severity,” and the other 12 as “Low Severity.” Subsequently, on...

openssl security update

1.0.1e-48.3 - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in DTLS - fix CVE-2016-2180 - OOB read in TSOBJprintbio - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue - fix...

CVE-2016-4745

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...

CVE-2016-4745

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...

Design/Logic Flaw

The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...