The vulnerability of the libsss_certmap package from the access control service for remote directories and the sssd authentication mechanism allows a perpetrator to increase their privileges.

The vulnerability of the libssscertmap package, a service for managing access to remote directories and an authentication mechanism for sssd, is related to the inability to clear certificate data when using LDAP filtering. Exploiting this vulnerability could allow a malicious actor to increase...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

CVE-2022-4254

sssd: libssscertmap fails to sanitise certificate data used in LDAP filters...

sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters

A vulnerability was found in SSSD, in the libssscertmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT...

libreoffice: Content Manipulation with Double Certificate Attack

LibreOffice improperly validated signatures which by manipulation of signatures xml files allowed for multiple certificate data to be combined and led to the ability to show content as validly signed even if it was not content related to the signature...

The vulnerability of Thunderbird email client, Firefox and Firefox ESR browsers, arises from improper validation of an empty sequence “pkcs7” when it is transmitted as part of the certificate data. This allows attackers to execute a DoS (Denial-of-Service) attack.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to improper validation of an empty pkcs7 sequence that is transmitted as part of the certificate data. Exploiting this vulnerability allows a remote attacker to send a specially crafted...

CVE-2022-22747

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla: Crash when handling empty pkcs7 sequence

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla: Crash when handling empty pkcs7 sequence

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla: Crash when handling empty pkcs7 sequence

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla: Crash when handling empty pkcs7 sequence

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla: Crash when handling empty pkcs7 sequence

The Mozilla Foundation Security Advisory describes this flaw as: After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable...

Mozilla Firefox ESR < 91.5

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-02 advisory. - Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyso...

LibreOffice Trust Management Issues Vulnerability (CNVD-2022-55627)

LibreOffice is a suite that is compatible with other major office softwares and can be executed on a variety of platforms. A vulnerability exists in LibreOffice due to a trust management issue. An attacker could use this vulnerability to create digitally signed ODF documents by manipulating the...

CVE-2021-25633

LibreOffice improperly validated signatures which by manipulation of signatures xml files allowed for multiple certificate data to be combined and led to the ability to show content as validly signed even if it was not content related to the signature...

Input validation

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to...

LibreOffice 信任管理问题漏洞

LibreOffice is a suite that is compatible with other major office softwares and can be executed on a variety of platforms. A vulnerability exists in LibreOffice due to a trust management issue. An attacker could use this vulnerability to create digitally signed ODF documents by manipulating the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Go. Vulnerability Details CVEID: CVE-2020-9283 DESCRIPTION: Golang golang.org/x/crypto is vulnerable to a denial of service, caused by an error during signature verification in the golang.org/x/crypto/ssh...

PT-2023-1263 · Sssd +6 · Sssd +6

Name of the Vulnerable Software and Affected Versions: sssd versions affected versions not specified Description: The issue is related to the libsss certmap package of the sssd service, which is responsible for managing access to remote directories and authentication mechanisms. It is associated...

Security update for openconnect (moderate)

openSUSE Security Update: Security update for openconnect Announcement ID: openSUSE-SU-2020:0997-1 Rating: moderate References: 1171862 Cross-References: CVE-2020-12823 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...