CVE-2017-11105

The OnePlus 2 Primary Bootloader PBL does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation...

CVE-2017-11105

The CVE-2017-11105 vulnerability affects the OnePlus 2 Primary Bootloader (PBL). The PBL does not validate the SBL1 partition before executing it, even though the partition contains a certificate. This allows an attacker with write access to the SBL1 partition to disable signature validation. The...

CVE-2017-9457

Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...

Input validation

Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...

CVE-2017-9457

The CVE-2017-9457 issue affects CompuLab Intense PC (Phoenix SecureCore) UEFI firmware. The root cause is missing capsule signature verification during firmware upgrades, enabling an attacker with administrator privileges to flash a modified UEFI BIOS. CNVD-2017-26600 specifies vulnerability in f...

CVE-2017-9457

Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...

Missing Message Validation

fedmsg is missing message validation. The library contains a bug where the base class' default value does not enable signature validation...

Missing Certificate Request Signature Validation

crypto/x509 in github.com/golang/go is missing certificate request signature validation. The library does not check the binding of the private key i.e., signature validation to its corresponding entities' certificate...

Response Wrapping Attacks

Python3-saml is vulnerable to response wrapping attacks. These attacks are possible in environments supporting EncryptedAssertion. The signature validation didn't verify the the number of locations and signed elements matched the expected numbers...

DEBIAN-CVE-2016-9122

go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...

PT-2017-9959 · Go · Go-Jose

Name of the Vulnerable Software and Affected Versions: go-jose versions prior to 1.1.0 go-jose versions prior to 1.0.4 Description: The go-jose library is affected by an issue related to multiple signatures exploitation. When validating a signed message, the API does not indicate which signature ...

Nextcloud: Update php-saml library to 2.10.5

The php-saml library as used by our SSO implementation had a minor security patch in 2.10.4 as per https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1. So we should update this in our next minor releases. Security update for signature validation on...

DEBIAN-CVE-2016-9814

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service memory consumption by leveraging...

MGASA-2017-0033 Updated pdns packages fix security vulnerabilities

Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record CVE-2016-2120. Florian Heinz and...

Fedora 24 : fedmsg (2017-a73bc7ac5d)

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validatesignatures switch. There was a bug here where the default value provided in the base class made it appear as ...

Fedora 25 : fedmsg (2017-fff6e1af37)

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validatesignatures switch. There was a bug here where the default value provided in the base class made it appear as ...

Partial Signature Validation

bouncycastle partially validates ASN1 encoded signatures in DSA mode. It is possible to inject extra values into the signatures and still have it validate...

Partial Signature Validation

bouncycastle partially validates ASN1 encoded signatures in ECDSA mode. It is possible to inject extra values into the signatures and still have it validate...

Fedora 23 : php-simplesamlphp-saml2 / php-simplesamlphp-saml2_1 (2016-5c32bae671)

v1.10.3 / v2.3.3 - This is a security release fixing an issue with signature validation. Please upgrade as soon as possible. - 201612-01 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

[SECURITY] [DSA 3733-1] apt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3733-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 13, 2016 https://www.debian.org/security/faq -...