7733 matches found
UBUNTU-CVE-2016-2085
The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack...
Debian DSA-3474-1 : libgcrypt20 - security update
Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack. See https://www.cs.tau.ac.IL/tromer/ecdh/ for details. %NASLMINLEVEL 70300 C Tenable Network Securit...
Debian: Security Advisory (DSA-3478-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 3474-1] libgcrypt20 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3474-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 12, 2016 https://www.debian.org/security/faq -...
[SECURITY] [DSA 3474-1] libgcrypt20 security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3474-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 12, 2016 https://www.debian.org/security/faq -...
DSA-3474-1 libgcrypt20 - security update
Bulletin has no description...
libgcrypt -- side-channel attack on ECDH
GnuPG reports: Mitigate side-channel attack on ECDH with Weierstrass curves...
MIT Develops Hack-Proof RFID Chip — Here's How It Works
Do you know about RFID chips and how many you are carrying at this moment? Today, RFID chips are built-in all sorts of items, including your credit cards, travel swipe cards, library books, grocery store cards, security tags, implanted medical records, passports and even the access cards provided...
VMware ESXi Multiple OpenSSL Vulnerabilities (VMSA-2014-0004) (Heartbleed)
The remote VMware ESXi host is affected by multiple vulnerabilities in the OpenSSL third-party library : - A flaw exist in the Elliptic Curve Digital Signature Algorithm ECDSA implementation due to a failure to ensure that certain swap operations have a constant-time behavior. An attacker can...
Automattic: Possible Timing Side-Channel in XMLRPC Verification
https://github.com/Automattic/jetpack/blob/bc7a4541ef6f0e9f583376d801ab0c40cfb976c3/class.jetpack-xmlrpc-server.phpL115 I mentioned this to @daljo628 and he suggested submitting it here instead. This looks very much like a classic timing attack vulnerability. The fix would be to use hashequals...
WordPress < 4.2.4 Multiple Vulnerabilities
Binary data 9031.prm...
WordPress Multiple Vulnerabilities (Dec 2015) - Linux
WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...
openSUSE Security Update : python-tornado (openSUSE-2015-741)
python-tornado was updates to fix one security issue. The following vulnerability was fixed : - CVE-2014-9720: XSRF cookie allowed side-channel attack against TLS BREACH %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
CVE-2015-5730
The sanitizewidgetinstance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated...
DEBIAN-CVE-2015-5730
The sanitizewidgetinstance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated...
CVE-2015-5730
The sanitizewidgetinstance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated...
Design/Logic Flaw
The sanitizewidgetinstance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated...
CVE-2015-5730
The sanitizewidgetinstance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated...
CVE-2015-5730
CVE-2015-5730 affects WordPress prior to 4.2.4, where sanitize_widget_instance in wp-includes/class-wp-customize-widgets.php does not use a constant-time comparison, enabling a timing side-channel attack on widgets. Public sources (including Debian DSA-3332 and related advisories) corroborate a t...