Oracle Linux 8 : libreoffice (ELSA-2022-1766)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1766 advisory. - Resolves: rhbz2013858 CVE-2021-25633 - Resolves: rhbz2014215 CVE-2021-25634 - Resolves: rhbz2014209 CVE-2021-25635 Tenable has extracted the precedin...

TYPO3 Improper Access Control vulnerability

The old Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors...

GHSA-9HCJ-H2QC-689P OpenStack Cinder file disclosure in image convert

OpenStack Cinder before 2014.1.5 icehouse, 2014.2.x before 2014.2.4 juno, and 2015.1.x before 2015.1.1 kilo allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command...

Insufficient Data Verification in io.really:jwt-scala

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token...

SimpleSAMLphp saml2 incorrect signature validation

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP...

GHSA-W7CQ-J9P9-HM3M Improper Input Validation in Apache Santuario XML Security

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document...

Executors need to be trusted

62 comment Warden: cmichel Executors need to be trusted, otherwise, they can just call sendFundsToUser to transfer out any funds as they please. Consider adding threshold signatures to prevent all funds from being lost when a single executor is compromised. --- The text was updated successfully,...

OESA-2022-1640 opensc security update

OpenSC provides a set of libraries and utilities to work with smart cards.Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the standard APIs to smar...

libreoffice: Content Manipulation with Double Certificate Attack

LibreOffice improperly validated signatures which by manipulation of signatures xml files allowed for multiple certificate data to be combined and led to the ability to show content as validly signed even if it was not content related to the signature...

libreoffice: Content Manipulation with Certificate Validation Attack

A flaw was found in LibreOffice, where it improperly validated signatures for algorithms that were not verified. This flaw leads to LibreOffice presenting a valid signature when the validity of the signature was not verified. The highest threat from this vulnerability is to confidentiality and...

Debian: Security Advisory (DSA-5132-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5132-1 : ecdsautils - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5132 advisory. It was discovered that ecdsautils, a collection of ECDSA elliptic curve cryptography CLI tools verified some cryptographic signatures incorrectly: A signature...

Voting power of new validators not checked in updateValset function, Gravity.sol

Lines of code Gravity.solL276-L358 Vulnerability details Impact While the voting power of the current valset is checked when the checkValidatorSignatures function is called in updateValset, the power of the new valset is not. This could cause some functions to not work since whenever...

[SECURITY] [DSA 5132-1] ecdsautils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5132-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 08, 2022 https://www.debian.org/security/faq -...

[SECURITY] [DLA 2997-1] ecdsautils security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2997-1 [email protected] https://www.debian.org/lts/security/ Sven Eckelmann May 07, 2022 https://wiki.debian.org/LTS -...

UBUNTU-CVE-2022-24884

ecdsautils is a tiny collection of programs used for ECDSA keygen, sign, verify. ecdsaverifypreparelegacy does not check whether the signature values r and s are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple...

CVE-2022-24884

CVE-2022-24884 affects ecdsautils, the ECDSA utilities library and CLI. The flaw is in ecdsautils’ signature verification: ecdsa_verify_[prepare_]legacy() does not reject zero-valued r or s, causing signatures comprised entirely of zeros to be deemed valid. Consequently, forged signatures can byp...

PT-2022-3495 · Unknown +2 · Ecdsautils +2

Name of the Vulnerable Software and Affected Versions: ecdsautils versions prior to 0.4.1 Description: The issue is related to the ecdsa verify prepare legacy function, which does not check whether the signature values r and s are non-zero. This allows for trivial signature forgery, as a signatur...

PT-2022-3499 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.6 XWiki Platform versions prior to 14.3.1 XWiki Platform versions prior to 14.4-rc-1 Description: The XWiki Crypto API generates X509 certificates signed by default using SHA1 with RSA, which is not...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1o-i586-1slack15.0.txz: Upgraded. Fixed a bug in the crehash script which was not properly sanitising shell...