Partial Signature Validation

bouncycastle partially validates ASN1 encoded signatures in ECDSA mode. It is possible to inject extra values into the signatures and still have it validate...

PT-2018-4980

Name of the Vulnerable Software and Affected Versions PowerDNS versions prior to 3.4.11 and 4.0.2 PowerDNS recursor versions prior to 4.0.4 Description The issue allows an attacker in a man-in-the-middle position to alter the content of an AXFR due to insufficient validation of TSIG signatures. A...

Fedora 23 : php-simplesamlphp-saml2 / php-simplesamlphp-saml2_1 (2016-5c32bae671)

v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - 201612-01 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

[SECURITY] [DSA 3733-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3733-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 13, 2016 https://www.debian.org/security/faq -...

DSA-3733-1 apt - security update

Bulletin has no description...

Fedora 24 : php-simplesamlphp-saml2 / php-simplesamlphp-saml2_1 (2016-b000091725)

v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - 201612-01 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Fedora 25 : php-simplesamlphp-saml2 / php-simplesamlphp-saml2_1 (2016-8b1f72df21)

v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - 201612-01 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

DLA-602-1 gnupg - security update

Bulletin has no description...

The vulnerability of the Microsoft .NET Framework software platform, which allows a perpetrator to forge digital signatures

The vulnerability of the Microsoft .NET Framework software arises from improper validation of digital signatures for individual elements of XML documents. Exploiting this vulnerability allows a malicious actor to forge digital signatures using modified XML documents...

CVE-2016-0132

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

Security feature bypass

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

CVE-2016-0132

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

CVE-2016-0132: Improper Input Validation

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."...

PT-2016-1370

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 2.0 SP2 through 4.6.1 Description The issue is related to the mishandling of signature validation for certain elements of XML documents, allowing remote attackers to spoof signatures via a modified document...

F5 Networks BIG-IP : Linux RPM vulnerability (SOL16383)

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory C Tenable Network...

openSUSE Security Update : Chromium (openSUSE-2015-912)

Chromium was updated to 47.0.2526.80 to fix security issues and bugs. The following vulnerabilities were fixed : - CVE-2015-6788: Type confusion in extensions - CVE-2015-6789: Use-after-free in Blink - CVE-2015-6790: Escaping issue in saved pages - CVE-2015-6791: Various fixes from internal audit...

Security update for Chromium (important)

Chromium was updated to 47.0.2526.80 to fix security issues and bugs. The following vulnerabilities were fixed: CVE-2015-6788: Type confusion in extensions CVE-2015-6789: Use-after-free in Blink CVE-2015-6790: Escaping issue in saved pages CVE-2015-6791: Various fixes from internal audits, fuzzin...

Security update for Chromium (important)

Chromium was updated to 47.0.2526.80 to fix security issues and bugs. The following vulnerabilities were fixed: CVE-2015-6788: Type confusion in extensions CVE-2015-6789: Use-after-free in Blink CVE-2015-6790: Escaping issue in saved pages CVE-2015-6791: Various fixes from internal audits, fuzzin...

CVE-2015-6783

The FindStartOffsetOfFileInZipFile function in crazylinkerzip.cpp in crazylinker aka Crazy Linker in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP...

CVE-2015-6783

The FindStartOffsetOfFileInZipFile function in crazylinkerzip.cpp in crazylinker aka Crazy Linker in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP...