SUSE-SU-2016:3079-1 Security update for tomcat

This update for Tomcat provides the following fixes: Feature changes: The embedded Apache Commons DBCP component was updated to version 2.0. bsc1010893 fate321029 Security fixes: - CVE-2016-0762: Realm Timing Attack bsc1007854 - CVE-2016-5018: Security Manager Bypass bsc1007855 - CVE-2016-6794:...

Timing Attack

django-debug-toolbar is vulnerable to timing attacks. The library is vulnerable because they do not compare HMACs in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid HMAC hashes...

Timing Attack

django-simple-sso is vulnerable to timing attacks. The library is vulnerable because they do not compare signatures in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid signature...

chromium-browser: same-origin bypass in svg

A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...

FreeBSD : cryptopp -- multiple vulnerabilities (eab68cff-bc0c-11e6-b2ca-001b3856973b)

Multiple sources report : CVE-2015-2141: The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack...

CVE-2016-5224

A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...

UBUNTU-CVE-2016-5224

A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...

MGASA-2016-0408 Updated virtualbox packages fixes security vulnerabilities

This update provides virtualbox 5.1.10 maintenance release and resolves at least the following security issues: OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and...

CVE-2016-5224

A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...

AIX OpenSSH Advisory : openssh_advisory9.asc

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities : - An elevation of privilege vulnerability exists in the dosetupenv function within file session.c when handling user-supplied environmental variables. A local attacker can exploit this to ga...

Mozilla Firefox < 50.0 Multiple Vulnerabilities

Binary data 9804.prm...

389 security update

CentOS Errata and Security Advisory CESA-2016:2594 An update for 389-ds-base is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2016-9077

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox 50...

Mozilla Firefox Timing Attack Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A timing attack vulnerability exists in the Canvas filter in versions of Mozilla Firefox prior to 50. An attacker can exploit this vulnerability to conduct timing attacks...

UBUNTU-CVE-2016-9077

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox 50...

RedHat Update for 389-ds-base RHSA-2016:2765-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 : 389-ds-base (ELSA-2016-2765)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2765 advisory. - Resolves: 1358559 - CVE-2016-4992 389-ds-base: Information disclosure via repeated use of LDAP ADD operation - Resolves: 1361421 - CVE-2016-5416...

389-ds-base: Password verification vulnerable to timing attack

It was found that 389 Directory Server was vulnerable to a remote password disclosure via timing attack. A remote attacker could possibly use this flaw to retrieve directory server password after many tries...

389-ds-base security, bug fix, and enhancement update

1.2.11.15-84 - Release 1.2.11.15-84 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-83 - Release 1.2.11.15-83 - Resolves: 1376676 - Backport AES storage scheme plugin DS 47462 1.2.11.15-82 - Release 1.2.11.15-82 - Resolves: 1376676 - Backport AES storage scheme plugin ...

Oracle Linux 7 : 389-ds-base (ELSA-2016-2594)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2594 advisory. - Resolves: bug 1360976 - EMBARGOED CVE-2016-5405 389-ds-base: Password verification vulnerable to timing attack - Resolves: bug 1350799 - CVE-2016-499...