CVE-2015-6783

The FindStartOffsetOfFileInZipFile function in crazylinkerzip.cpp in crazylinker aka Crazy Linker in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP...

CVE-2015-6783

Removed by vendor...

CVE-2015-6783

CVE-2015-6783 affects Google Chrome components on Android 5.x–6.x that use Crazy Linker. The vulnerability is in crazy_linker_zip.cpp FindStartOffsetOfFileInZipFile, where EOCD record search is faulty, allowing signature-validation bypass via a crafted ZIP archive. Public docs confirm this CVE wa...

CVE-2015-6783

The FindStartOffsetOfFileInZipFile function in crazylinkerzip.cpp in crazylinker aka Crazy Linker in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP...

PT-2015-7357

Name of the Vulnerable Software and Affected Versions crazy linker aka Crazy Linker versions prior to the version included in Google Chrome 47.0.2526.73 Google Chrome versions prior to 47.0.2526.73 Description The issue is related to the FindStartOffsetOfFileInZipFile function in crazy linker...

CVE-2015-6783: Improper Input Validation

The FindStartOffsetOfFileInZipFile function in crazylinkerzip.cpp in crazylinker aka Crazy Linker in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP...

FreeBSD : chromium -- multiple vulnerabilities (548f74bd-993c-11e5-956b-00262d5ed8ee)

Google Chrome Releases reports : 41 security fixes in this release, including : - 558589 Critical CVE-2015-6765: Use-after-free in AppCache. Credit to anonymous. - 551044 High CVE-2015-6766: Use-after-free in AppCache. Credit to anonymous. - 554908 High CVE-2015-6767: Use-after-free in AppCache...

Stable Channel Update

The Chrome team is delighted to announce the promotion of Chrome 47 to the stable channel for Windows, Mac and Linux. Chrome 47.0.2526.73 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new...

PT-2017-7310

Name of the Vulnerable Software and Affected Versions MediaWiki Extension:OAuth versions 1.25.x before 1.25.3 MediaWiki Extension:OAuth versions 1.24.x before 1.24.4 MediaWiki Extension:OAuth versions prior to 1.23.11 Description The issue concerns the MWOAuthDataStore::lookup token function in...

Qolsys IQ Panel contains multiple vulnerabilities

Overview All firmware versions of Qolsys IQ Panel contain hard-coded cryptographic keys, do not validate signatures during software updates, and use a vulnerable version of Android OS. Description Qolsys IQ Panel is an Android OS-based touch screen controller for home automation devices and...

SUSE: Security Advisory for MozillaFirefox (SUSE-SU-2015:1269-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Lenovo System Update Signature Validation Bypass Vulnerability

Lenovo System Update aka ThinkVantage System Update is a system update software from Lenovo. The service component of Lenovo System Update, SUService.exe, creates a named pipe to provide system update services to low-privileged processes.A security vulnerability in Lenovo System Update software...

Simple Streams Disk Forgery Vulnerability

Simple Streams is a library and tool for using simple streaming data. A vulnerability in Simple Streams fails to properly validate the GPG signature of a disk image file. Allowing a remote attacker to forge a disk image with a 403 response...

nevisAuth Authentication Bypass Vulnerability

nevisAuth versions since 4.13.0.0 2012-11-21 and prior to 4.18.3.1 2015-07-02 suffer from an authentication bypass vulnerability. Product: nevisAuth 1 Vendor: AdNovum 2 CVD ID: CVE-2015-5372 Subject: Authentication Bypass Risk: Critical Effect: Remotely exploitable Authors: Antoine Neuenschwander...

wolfssl -- leakage of private key information

Florian Weimer of Redhat discovered that an optimization in RSA signature validation can result in disclosure of the server's private key under certain fault conditions...

Oracle Linux 5 : nss (ELSA-2015-1664)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1664 advisory. - Resolves: Bug 1236954 - CVE-2015-2730 NSS: ECDSA signature validation fails to handle some signatures correctly MFSA 2015-64 Tenable has extracted th...

SUSE-SU-2015:1268-1 Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards bsc935979. - CVE-2015-2728: Type confusion in Index...

Microsec e-Szigno XML Digital Signature Forgery Security Bypass Vulnerability

Microsec e-Szigno is a suite of electronic signature authentication applications. Microsec e-Szigno does not validate the signature of specially crafted XML files, allowing attackers to bypass XML digital signature validation by performing man-in-the-middle attacks to forge XML file content and...

pyjwt Insecure HMAC Signature Validation Vulnerability

pyjwt is a JSON Web Token implementation in Python. The pyjwt insecure HMAC signature checksum vulnerability allows remote attackers to perform unauthorized operations or obtain sensitive information...

ECDSA signature validation fails to handle some signatures correctly — Mozilla

Mozilla community member Watson Ladd reported that the implementation of Elliptical Curve Cryptography ECC multiplication for Elliptic Curve Digital Signature Algorithm ECDSA signature validation in Network Security Services NSS did not handle exceptional cases correctly. This could potentially...