2386 matches found
OpenJDK: DSA implementation timing attack (Libraries, 8168728)
A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...
GLSA-201701-23 : Botan: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201701-23 Botan: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Botan. Please review the CVE identifiers referenced below for details. Impact : A remote attacker might obtain ECDSA secret keys via a timi...
Botan: Multiple vulnerabilities
Background Botan Japanese for peony is a cryptography library written in C++11. Description Multiple vulnerabilities have been discovered in Botan. Please review the CVE identifiers referenced below for details. Impact A remote attacker might obtain ECDSA secret keys via a timing side-channel...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed an XSS vulnerability in Security Library method xssclean. Fixed a possible file inclusion vulnerability in Loader Library method vars. Fixed a possible remote code execution vulnerability in the Email Library when ‘mail’ or ‘sendmail’ are used thanks to Pa...
Ubuntu: Security Advisory (USN-3163-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerabilities (USN-3163-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3163-1 advisory. It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause N...
USN-3163-1: NSS vulnerabilities
It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-5285 Hubert Kari...
Debian DLA-759-1 : nss security update
Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-201 6-9074 For Debian 7 'Wheezy', these problems have been fixed in version 2:3.26-1+debu7u2. We recommend that you...
[SECURITY] [DLA 759-1] nss security update
Package : nss Version : 2:3.26-1+debu7u2 CVE ID : CVE-2016-9074 Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-2016-9074 For Debian 7 "Wheezy", these problems have...
DLA-759-1 nss - security update
Bulletin has no description...
Kernel Address Space Layout Randomization Recovery Software
Kernel Address Space Layout Randomization Recovery Software KASLRfinder is a small utility that can be used to find where in memory the Windows 10 kernel and its drivers are loaded – despite the addresses being randomized by Kernel Address Space Layout Randomization KASLR. The utility can be run ...
CVE-2016-9074
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...
Security vulnerabilities fixed in Thunderbird 45.5 — Mozilla
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability require...
Updated nss and firefox packages fix security vulnerabilities
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291,...
CVE-2016-9074
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...
UBUNTU-CVE-2016-9074
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services NSS 3.26.1. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...
PT-2016-7641
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 50 Firefox ESR versions prior to 45.5 Thunderbird versions prior to 45.5 Description The issue arises from an insufficient existing mitigation of timing side-channel attacks. This can be exploited under certain...
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016
On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as “Critical Severity,” one as “Moderate Severity,” and the other 12 as “Low Severity.” Subsequently, on...
CVE-2016-4745
The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...
CVE-2016-4745
The Kerberos 5 aka krb5 PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier for remote attackers to enumerate user accounts via a timing side-channel attack...