UBUNTU-CVE-2016-9939

Crypto++ aka cryptopp and libcrypto++ 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length field of the ASN.1 object. If there is not enough content octets in the ASN.1 object, then the function will fail and the memory block will b...

Paragon Initiative Enterprises: Not clearing hex-decoded variable after usage in Authentication

All the sensitive information variables are zeroed from memory, expect the hex2bin value of "validator". https://github.com/paragonie/airship/blob/8f04f071c414c3893cf66311839d20a343af1237/src/Engine/Security/Authentication.phpL223-L236 $stored = \Sodium\hex2bin$record$f'validator';...

Tor: [tor] pre-emptive defenses, potential vulnerabilities

Replacing all tormalloc calls with torcalloc and tormalloczero ============================================================== Zeroing memory upon allocating it will prevent vulnerabilities that consist of transmitting data buffers which are not wholly initialized with the intended data or contain...

MIT Kerberos 5 multiple potential security vulnerabilities

Memory leaks, insufficient memory zeroing, etc...

USN-2124-2: OpenJDK 6 regression

USN-2124-1 fixed vulnerabilities in OpenJDK 6. Due to an upstream regression, memory was not properly zeroed under certain circumstances which could lead to instability. This update fixes the problem. We apologize for the inconvenience. Original advisory details: A vulnerability was discovered in...

[SECURITY] [DSA 2148-1] Security update for tor

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2148-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 17, 2011 http://www.debian.org/security/faq -...

Debian DSA-2148-1 : tor - several vulnerabilities

The developers of Tor, an anonymizing overlay network for TCP, found three security issues during a security audit. A heap overflow allowed the execution of arbitrary code CVE-2011-0427 , a denial of service vulnerability was found in the zlib compression handling and some key memory was...

DSA-2148-1 tor - several

Bulletin has no description...

Design/Logic Flaw

Virtual Desktop Server Manager VDSM in Red Hat Enterprise Virtualization Hypervisor aka RHEV-H or rhev-hypervisor before 5.5-2.2 does not properly perform VM post-zeroing after the removal of a virtual machine's data, which allows guest OS users to obtain sensitive information by examining the di...

CVE-2010-2223

CVE-2010-2223 affects Red Hat Enterprise Virtualization Hypervisor (RHEV-H) with Virtual Desktop Server Manager (VDSM). The issue: when removing a VM’s data, VDSM did not securely zero/delete the back-end data, allowing a guest OS user to examine disk blocks from deleted VMs and potentially discl...

vdsm: missing VM post-zeroing after removal

Previously, the ISO image domain could not be shared with multiple Data Centers. The user had to define an independent ISO domain for each Data Center. With this update, the ISO image domain can be shared between multiple Data Centers...

vdsm: missing VM post-zeroing after removal

Previously, the ISO image domain could not be shared with multiple Data Centers. The user had to define an independent ISO domain for each Data Center. With this update, the ISO image domain can be shared between multiple Data Centers...

CVE-2007-6716

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service OOPS, as demonstrated by a certain fio test...

CVE-2006-3597

passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the installer's memory...

CVE-2006-3597

passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the "Go Back" option after the final "Installation complete" message and uses the main menu, which causes the password to be zeroed out in the installer's memory...