google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

SUSE-SU-2022:2320-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution bmo1771381 - CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid bmo1775441 - CVE-2022-31744: CSP bypass enabling...

openSUSE: Security Advisory for openssl-3 (SUSE-SU-2022:2306-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Linux 9 : thunderbird (ELSA-2022-5482)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-5482 advisory. 91.11.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires...

Oracle Linux 9 : thunderbird (ELSA-2022-4589)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-4589 advisory. 91.9.0-3.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Reference oracle-indexhtml within Requires Orabu...

What Are the Security Benefits of Using a Digital Signature?

By Owais Sultan In our digital age, it’s now become commonplace to sign documents online using what is known as a… This is a post from HackRead.com Read the original post: What Are the Security Benefits of Using a Digital Signature?...

SUSE-SU-2022:2306-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2022-2068: Fixed more shell code injection issues in crehash. bsc1200550 - CVE-2022-1292: Properly sanitise shell metacharacters in crehash script. bsc1199166 - CVE-2022-1343: Fixed incorrect signature verification in OCSPbasicverify...

Updated thunderbird packages fix security vulnerability

A popup window could be resized in a way to overlay the address bar with web content. CVE-2022-34479 Use-after-free in nsSHistory. CVE-2022-34470 CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. CVE-2022-34468 An email with a mismatching OpenPGP signature...

MGASA-2022-0253 Updated thunderbird packages fix security vulnerability

A popup window could be resized in a way to overlay the address bar with web content. CVE-2022-34479 Use-after-free in nsSHistory. CVE-2022-34470 CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. CVE-2022-34468 An email with a mismatching OpenPGP signature...

Debian DSA-5175-1 : thunderbird - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5175 advisory. Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code. For the oldstable...

Debian: Security Advisory (DSA-5174-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : GnuPG vulnerability (USN-5503-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5503-1 advisory. Demi Marie Obenour discovered that GnuPG incorrectly handled injection in the status message. A remote attacker could possibly use this...

Denial Of Service (DoS)

thunderbird is vulnerable to denial of service. The vulnerability exists when an OpenPGP digital signature includes information about the date when the signature was created which allows an attacker to cause an application crash...

Signature Forgery

gnupg2 is vulnerable to signature forgery. The vulnerability exists when an attacker possesses any secret-key information from a victim’s keyring and other constraints are met causing a forgery...

The vulnerability of the Thunderbird email client arises from the lack of correlation between the date of the OpenPGP digital signature and the date of the electronic email. This allows attackers to perform spamming attacks.

The vulnerability of Thunderbird email client stems from the lack of correlation between the date of the OpenPGP digital signature and the date of the email message. Exploiting this vulnerability could allow a remote attacker to perform a spamming attack...

CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...

Debian DSA-5174-1 : gnupg2 - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5174 advisory. Demi Marie Obenour discovered a flaw in GnuPG, allowing for signature spoofing via arbitrary injection into the status line. An attacker who controls the secret part ...

UBUNTU-CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...

Grafana -- Plugin signature bypass

Grafana Labs reports: On July 4th as a result of an internal security audit we have discovered a bypass in the plugin signature verification by exploiting a versioning flaw. We believe that this vulnerability is rated at CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L...

[SECURITY] [DSA 5174-1] gnupg2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5174-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 03, 2022 https://www.debian.org/security/faq -...