7727 matches found
pam security update
1.6.1-9.1 - pamuserdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704...
CVE-2026-53525
A flaw was found in WeeChat, a free chat client. The relay authentication mechanism uses a non-constant-time comparison when verifying password hashes. This vulnerability allows a remote attacker to exploit subtle timing differences during the authentication process. By analyzing these timing...
Astra Linux – Vulnerability in mbedtls
A vulnerability was discovered in Arm Mbed TLS before versions 2.16.6 and 2.7.x, prior to 2.7.15. An attacker who can obtain precise side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinates of the result of scalar multiplication by...
Astra Linux – Vulnerability in Linux
In kernel/bpf/verifier.c in the Linux kernel before version 5.12.13, a branch prediction can be mispredicted e.g., due to type confusion, allowing a non-privileged BPF program to access arbitrary memory locations through a side-channel attack, known as CID-9183671af6db...
Astra Linux – Vulnerability in mbedtls
A issue was discovered in Arm Mbed TLS before version 2.23.0. A side channel allows the recovery of an ECC private key, which is related to functions such as mbedtlsecpcheckpubpriv, mbedtlspkparsekey, mbedtlspkparsekeyfile, mbedtlsecpmul, and mbedtlsecpmulrestartable...
Astra Linux – Vulnerability in wpa
Implementations of EAP-pwd in hostapd before version 2.10 and wpasupplicant before version 2.10 are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists because of an incomplete fix for CVE-2019-9495...
Astra Linux – Vulnerability in OpenSSL
Issue summary: A timing side-channel that could potentially allow the recovery of the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow an attacker to recover the private key. However, measuring the timing woul...
Astra Linux – Vulnerability in wpa
Implementations of SAE in hostapd before version 2.10, and wpasupplicant before version 2.10, are vulnerable to side-channel attacks due to cache access patterns. NOTE: This issue exists due to an incomplete fix for CVE-2019-9494...
Astra Linux – Vulnerability in mbedtls
A vulnerability was discovered in Arm Mbed TLS prior to version 2.24.0. An attacker can obtain a private key for RSA or static Diffie-Hellman through a side-channel attack targeting the generation of base blinding/unblinding values...
Astra Linux – Vulnerability in nss
During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...
Astra Linux – Vulnerability in Chromium
Leakage of side-channel information in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write operations through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Leakage of side-channel information in DevTools in Google Chrome prior to version 94.0.4606.54 allowed a remote attacker to bypass site isolation through a crafted HTML page...
Astra Linux – Vulnerability in mbedtls
The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS from 2.19.1 onwards does not reduce the blinded scalar before computing the inverse. This allows a local attacker to recover the private key through side-channel attacks...
Astra Linux – Vulnerability in Chromium
Side-channel information leakage in navigation and loading processes in Google Chrome prior to version 139.0.7258.66 allowed a remote attacker to bypass site isolation through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel through version 5.11.x. The kernel/bpf/verifier.c file contains unwanted out-of-bounds speculation during pointer arithmetic operations, which allows for side-channel attacks that circumvent Spectre mitigations and extract sensitive information from kern...
Vulnerabilities of the functions tcp_inbound_md5_hash(), tcp_v4_send_reset(), and tcp_v6_send_reset() in the Linux operating system, which allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerabilities of the functions tcpinboundmd5hash, tcpv4sendreset, and tcpv6sendreset in the Linux operating system are related to the disclosure of information due to the observed difference in execution time. Exploiting these vulnerabilities can allow a remote attacker to compromise the...
CVE-2026-74961
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Side-channel in the Web Audio component...
CVE-2026-74954
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure due to side-channel in the Storage: Cache API component...
SUSE CVE-2026-74954
Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...