ROS-20240729-05

Vulnerability in the libssh2 library of Libgit2's implementation of Git's C methods is related to validation bugs of cryptographic signatures. Exploitation of the vulnerability could allow an attacker acting remotely, execute a man-in-the-middle attack...

Important: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads CVE-2024-1394 For more details about the securit...

RADIUS Protocol under RFC 2865 安全漏洞

RADIUS Protocol under RFC 2865 is an RFC open source networking protocol. A security vulnerability exists in RADIUS Protocol under RFC 2865, which can be exploited by an attacker to modify any valid response Access-Accept, Access-Reject, or Access-Challenge to any other response using a Choice...

WordPress Qualified Electronic Signatures by eID Easy plugin <= 3.3.0 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Qualified Electronic Signatures by eID Easy versions = 3.3.0...

WordPress Qualified Electronic Signatures by eID Easy Plugin <= 3.3.0 is vulnerable to Backdoor

Software Qualified Electronic Signatures by eID Easy Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7c90ad9b98a6 Credits Sansec.io Required privilege...

The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems allows a hacker to increase their privileges.

The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems stems from the lack of checks for verifying the signature of the dependencies before they are imported. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2025-3822

Name of the Vulnerable Software and Affected Versions Ruby affected versions not specified Description The Ruby interpreter is susceptible to the Marvin Attack, which leverages a covert timing channel to transmit data. This issue allows a remote attacker to decrypt previously encrypted messages o...

The vulnerability of the Acrobat Mobile Sign software for working with electronic signatures and document management lies in the incorrect restriction on the path to the restricted catalog. This allows attackers to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the Acrobat Mobile Sign software for working with electronic signatures and document management is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a perpetrator to bypass existing security...

The vulnerability of the Acrobat Mobile Sign software in handling electronic signatures and document management is related to deficiencies in the authentication process. This allows unauthorized users to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the Acrobat Mobile Sign software for working with electronic signatures and document management is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and gain unauthorized acces...

[slackware-security] emacs

New emacs packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/emacs-29.4-i586-1slack15.0.txz: Upgraded. Emacs 29.4 is an emergency bugfix release intended to fix a security vulnerability: Arbitrar...

PT-2024-20202 · Alpine · Alpine Halo9

Name of the Vulnerable Software and Affected Versions: Alpine Halo9 affected versions not specified Description: This issue allows physically present attackers to bypass the signature validation mechanism on affected installations of Alpine Halo9 devices. No authentication is required to exploit...

Recovering Public Keys from Signatures

Interesting summary of various ways to derive the public key from digitally signed files. Normally, with a signature scheme, you have the public key and want to know whether a given signature is valid. But what if we instead have a message and a signature, assume the signature is valid, and want ...

SUSE CVE-2024-37305

oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODEUINT32 at the start of...

CVE-2024-37305

oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODEUINT32 at the start of...

CVE-2024-37305 Buffer overflow in deserialization in oqs-provider

oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODEUINT32 at the start of...

CVE-2024-36277: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. The affected app cannot detect event data with invalid signatures...

PT-2024-26945 · Freefrom · Freefrom

Name of the Vulnerable Software and Affected Versions: FreeFrom - the nostr client versions prior to 1.3.5 Description: The issue is related to improper verification of cryptographic signatures. This means the affected app cannot detect event data with invalid signatures, potentially allowing...

PT-2024-27463 · Unknown +1 · Oqs-Provider +1

Name of the Vulnerable Software and Affected Versions: oqs-provider versions prior to 0.6.1 Description: The issue arises from the way oqs-provider handles lengths decoded with DECODE UINT32 at the start of serialized hybrid keys and signatures. Unchecked length values are later used for memory...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.11.1-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For mo...