715 matches found
openSUSE Security Update : ntp (openSUSE-2016-599)
This update for ntp to 4.2.8p7 fixes the following issues : - CVE-2016-1547, bsc977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS. - CVE-2016-1548, bsc977461: Interleave-pivot - CVE-2016-1549, bsc977451: Sybil vulnerability: ephemeral association attack. - CVE-2016-1550, bsc977464: Improve NTP...
Mageia: Security Advisory (MGASA-2016-0147)
The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Google Chrome < 50.0.2661.94 Multiple Vulnerabilities
The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.94. It is, therefore, affected by multiple vulnerabilities as referenced in the 201604stable-channel-update28 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attacke...
Debian DLA-406-1 : phpmyadmin security update
Several flaws were discovered in the CSRF authentication code of phpMyAdmin. CVE-2016-2039 The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values. CVE-2016-2041 The comparison of the XSRF/CSRF token parameter with the value saved ...
[SECURITY] [DLA 406-1] phpmyadmin security update
Package : phpmyadmin Version : 4:3.3.7-11 CVE ID : CVE-2016-2039 CVE-2016-2041 Several flaws were discovered in the CSRF authentication code of phpMyAdmin. CVE-2016-2039 The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values...
phpmyadmin -- Unsafe comparison of XSRF/CSRF token
The phpMyAdmin development team reports: The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF token matches a particular pattern. We consider this vulnerability to be seriou...
Unsafe comparison of XSRF/CSRF token.
PMASA-2016-5 Announcement-ID: PMASA-2016-5 Date: 2016-01-24 Summary Unsafe comparison of XSRF/CSRF token. Description The comparison of the XSRF/CSRF token parameter with the value saved in the session is vulnerable to timing attacks. Moreover, the comparison could be bypassed if the XSRF/CSRF...
CVE-2005-1797
The design of Advanced Encryption Standard AES, aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations...
Oracle Java SE 6 < Update 101 / 7 < Update 85 / 8 < Update 51 Multiple Vulnerabilities
Binary data 8918.prm...
FreeBSD : mediawiki -- multiple vulnerabilities (6241b5df-42a1-11e5-93ad-002590263bf5)
MediaWiki reports : Internal review discovered that Special:DeletedContributions did not properly protect the IP of autoblocked users. This fix makes the functionality of Special:DeletedContributions consistent with Special:Contributions and Special:BlockList. Internal review discovered that...
OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)
It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons...
OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)
It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons...
OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)
It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons...
OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)
It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons...
libcrypto++ timing attacks
Rabin-Williams algorithm timing attacks...
Astoria — Advanced Tor Client Designed to Avoid NSA Attacks
In response to the threat of intelligence agencies like NSA and GCHQ, Security researchers from American and Israeli academics have developed a new advanced Tor client called Astoria specially designed to make eavesdropping harder. Tor The Onion Router is the most popular anonymity network that i...
Fortinet FortiWeb Multiple Vulnerabilities in OpenSSL (FG-IR-14-018)
Fortinet FortiWeb is prone to multiple vulnerabilities in OpenSSL. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
WP API: Cryptographic Side Channel in OAuth Library
Because hashes and tokens are compared with the !== and === operators, these checks may be susceptible to timing attacks. More info: http://codahale.com/a-lesson-in-timing-attacks/ Affected code:...
[USN-2325-1] OpenStack Nova vulnerability
========================================================================== Ubuntu Security Notice USN-2325-1 August 21, 2014 nova vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...
USN-2325-1: OpenStack Nova vulnerability
Alex Gaynor discovered that OpenStack Nova would sometimes respond with variable times when comparing authentication tokens. If nova were configured to proxy metadata requests via Neutron, a remote authenticated attacker could exploit this to conduct timing attacks and ascertain configuration...