[SECURITY] Fedora 17 Update: gnupg2-2.0.19-7.fc17

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 18 Update: gnupg-1.4.13-2.fc18

GnuPG GNU Privacy Guard is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with...

[SECURITY] Fedora 18 Update: gnupg2-2.0.19-7.fc18

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

Debian Security Advisory DSA 2601-1 (gnupg, gnupg2 - missing input sanitation)

KB Sriram discovered that GnuPG, the GNU Privacy Guard did not sufficiently sanitise public keys on import, which could lead to memory and keyring corruption. The problem affects both version 1, in the gnupg package, and version two, in the gnupg2 package. OpenVAS Vulnerability Test $Id:...

DEBIAN-CVE-2012-6426

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data...

Fedora 18 : kernel-3.6.7-5.fc18 (2012-18740)

Fixes CVE-2012-4461 and adds support for two rebranded BCM20702A0 bluetooth adapters. Also adds 1/2 of the fix for bug 859485. Latest upstream stable release v3.6.7. As usual, fixes across the tree. In addition to the listed bugs, this also fixes : - correct module signatures on PAE and...

Fortigate UTM appliances share the same default CA certificate

Overview Fortigate UTM appliances that support SSL/TLS deep packet inspection share the same self-signed Fortigate CA certificate and associated private key across all devices. The private key, which has been compromised, allows attackers to create and sign fake certificates. Description Fortigat...

FBI and computer scientists team up to catch hackers

FBI's Cyber Division has a new and sharper focus on cyber-intrusion ,"You are one click from compromising your network" FBI said. Giving priority to the labeling of suspects follows claims by the Pentagon that the military now has the capability to single out and retaliate against hackers. FBI ov...

New windows malware can target smart cards for full remote access

If you think that having a USB Token Smartcard is extremely secure for Digital signatures or other activities, you may be wrong! The research done by Paul Rascagneres can remotely give access to victims smartcard! What makes the attack unique is it uses a keylogger to get the PIN or password and...

[slackware-security] seamonkey

New seamonkey packages are available for Slackware 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/seamonkey-2.13.1-i486-1.txz: Upgraded. This update contains security fixes and improvements. For more information, see:...

What's the Meaning of This: Adobe Certificate Attack

The news yesterday that Adobe had been compromised and that the attackers were able to get valid Adobe signatures on a pair of malware utilities is one of the more worrisome and troubling stories in what has become a year of huge hacks and historic change in the security industry. Adobe was...

Fedora Update for rpmdevtools FEDORA-2012-13234

Check for the Version of rpmdevtools OpenVAS Vulnerability Test Fedora Update for rpmdevtools FEDORA-2012-13234 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it und...

[SECURITY] Fedora 16 Update: rpmdevtools-8.3-1.fc16

This package contains scripts and XEmacs support files to aid in development of RPM packages. rpmdev-setuptree Create RPM build tree within user's home directory rpmdev-diff Diff contents of two archives rpmdev-newspec Creates new .spec from template rpmdev-rmdevelrpms Find and optionally remove...

[SECURITY] Fedora 17 Update: rpmdevtools-8.3-1.fc17

This package contains scripts and XEmacs support files to aid in development of RPM packages. rpmdev-setuptree Create RPM build tree within user's home directory rpmdev-diff Diff contents of two archives rpmdev-newspec Creates new .spec from template rpmdev-rmdevelrpms Find and optionally remove...

Mandrake Linux Security Advisory : gnupg (MDKSA-2000:087)

When importing keys from public key servers, GnuPG will import private keys also known as secret keys in addition to public keys. If this happens, the user's web of trust becomes corrupt. Additionally, when used to check detached signatures, if the data file being checked contains clearsigned dat...

Mobile Malware Is Up – Way Up – in McAfee Q2 Threat Report

McAfee Labs researchers today announced a surge in malware samples this year – particularly threats that take advantage of mobile networks to launch drive-by downloads, control botnets using Twitter and spread ransomware that locks down infected machines and demand payments from users. The Santa...

Adobe Reader fails to properly handle signatures

Overview Adobe Reader fails to properly handle RSA signatures. Adobe Reader contains an issue where it may fail to properly verify RSA signatures. Masahiko Takenaka of FUJITSU LABORATORIES LTD. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

JVN#51615542: Adobe Reader fails to properly handle signatures

Adobe Reader contains an issue where it may fail to properly verify RSA signatures. Impact An attacker may be able to forge an RSA signature on a PDF document. Solution Update the software Update to the latest version according to the information provided by the developer. Note that this issue wa...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-2409 deprecate MD2 in SSL cert validation Kaminsky CVE-2009-4355 openssl significant memory leak in certain SSLv3 requests DoS It was found that the OpenSSL library did not properly re-initialize its internal state in the SSLlibraryinit function after previous calls to the...

Scientific Linux Security Update : xmlsec1 on SL4.x, SL5.x i386/x86_64

CVE-2009-0217 xmlsec1, mono, xml-security-c, xml-security-1.3.0-1jpp.ep1.: XMLDsig HMAC-based signatures spoofing and authentication bypass A missing check for the recommended minimum length of the truncated form of HMAC-based XML signatures was found in xmlsec1. An attacker could use this flaw t...