USN-2903-1: NSS vulnerability

Hanno Böck discovered that NSS incorrectly handled certain division functions, possibly leading to cryptographic weaknesses. CVE-2016-1938 This update also refreshes the NSS package to version 3.21 which includes the latest CA certificate bundle, and removes the SPI CA...

Ubuntu 14.04 LTS : Firefox regression (USN-2880-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2880-2 advisory. USN-2880-1 fixed vulnerabilities in Firefox. This update introduced a regression which caused Firefox to crash on startup with some configurations. This update...

Ubuntu: Security Advisory (USN-2880-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox Multiple Vulnerabilities (Jan 2016) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2880-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2880-1 advisory. Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, Randell Jesup, Nicolas Pierron, Eric Rescorla, Tyson Smith, and Gab...

Ubuntu: Security Advisory (USN-2880-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2880-1: Firefox vulnerabilities

Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, Randell Jesup, Nicolas Pierron, Eric Rescorla, Tyson Smith, and Gabor Krizsanits discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker...

Mozilla Firefox 44 Security Patches

Mozilla has patched a number of critical vulnerabilities in Firefox 44 and Firefox Extended Release 38.6, which were released this week. The most serious flaws were memory vulnerabilities that lived in both the public and extended support versions of the browser. A buffer overflow write in WebGL,...

Errors in mp_div and mp_exptmod cryptographic functions in NSS — Mozilla

Security researcher Hanno Böck reported that calculations with mpdiv and mpexptmod in Network Security Services NSS can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially crafted application...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the MediaTek misc-sd driver for the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created application...

The vulnerability of the application interface of the IBM WebSphere Portal server allows a hacker to circumvent existing access restrictions.

The vulnerability of the IBM WebSphere Portal application server’s user interface is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions by using a specially crafted request...

Fewer IPsec VPN Connections at Risk to Weak Diffie-Hellman

A challenge has been made against one of the conclusions in a potentially blockbuster academic paper on cryptographic weaknesses that may be the open door through which intelligence agencies are breaking encrypted connections. The paper, “Imperfect Forward Secrecy: How Diffie-Hellman Fails in...

NSA Exploiting Weak Diffie-Hellman Primes to Break Crypto

The great mystery since the NSA and other intelligence agencies’ cyber-spying capabilities became watercooler fodder has not been the why of their actions, but the how? For example, how are they breaking crypto to decode secure Internet communication? A team of cryptographers and computer...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially crafted application...

The vulnerability of the Internet Explorer browser, which allows a hacker to elevate their privileges

The vulnerability of the Internet Explorer browser is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially crafted web page...

Google Outlines Plans to Deprecate RC4, SSLv3

As expected, Google formally announced its intent to move away from the stream cipher RC4 and the SSLv3 protocol this week, citing a long history of weaknesses in both. Adam Langley, a security engineer for the company, announced the plans through a blog post on Thursday. While there isn’t a...

Google, Mozilla End RC4 Support

Google, Microsoft and Mozilla today announced they’ve settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. Attacks against RC4 are growing increasingly practical, rendering the algorithm more untrustworthy by the day. The browser makers plan to sever support for RC4...

Vulnerabilities of iOS and Mac OS X operating systems, which allow attackers to bypass the code signing protection mechanism

The vulnerability of iOS and Mac OS X operating systems is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass the code signing mechanism by adding code to the created executable file...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x, SL7.x i386/x86_64 (20150730) (Bar Mitzvah) (Logjam)

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733 A flaw was fou...