Mozilla Firefox Security Advisories (MFSA2020-36, MFSA2020-38) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Security Vulnerabilities fixed in Firefox 80 — Mozilla

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with administrative privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled...

Side Channel Attack

nss is vulnerable to side channel attack. It is possible because of a flaw in ECDSA signature generation...

CVE-2020-12400

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox 80 and Firefox for Android 80...

Side-Channel Attack

nss is vulnerable to side-channel attacks. An attacker is able to perform electromagnetic-based side channel attacks during RSA key generation to recover the secret primes...

Updated botan2 packages fix security vulnerability

The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length...

MGASA-2020-0308 Updated botan2 packages fix security vulnerability

The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length...

[ASA-202007-5] mbedtls: private key recovery

Arch Linux Security Advisory ASA-202007-5 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-10932 Package : mbedtls Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-1141 Summary ======= The package mbedtls before versio...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Sterling Connect:Express for UNIX (CVE-2016-0800, CVE-2016-0705, CVE-2016-0798, CVE-2016-0797, CVE-2016-0799, CVE-2016-0702, CVE-2016-0703, CVE-2016-0704)

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVEs including the “DROWN: Decrypting RSA with Obsolete and Weakened eNcryption"...

openSUSE Security Update : the Linux Kernel (openSUSE-2020-801)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This...

openSUSE Security Update : mozilla-nss (openSUSE-2020-953)

This update for mozilla-nss fixes the following issues : mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

openSUSE Security Update : xen (openSUSE-2020-818)

This update for xen to version 4.12.3 fixes the following issues : - CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling...

openSUSE Security Update : mozilla-nss (openSUSE-2020-955)

This update for mozilla-nss fixes the following issues : mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

CVE-2020-15107

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating the Linux System V Application Binary Interface ABI for such operations, a host app can compromise the execution integrity of some x87 FPU operations in an...

Design/Logic Flaw

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host application. By violating the Linux System V Application Binary Interface ABI for such operations, a host app can compromise the execution integrity of some x87 FPU operations in an...

CVE-2020-15107

CVE-2020-15107 affects OpenEnclave up to version 0.10.0: enclaves performing x87 FPU operations can be tampered by a malicious host app that violates the Linux SYSV ABI, compromising execution integrity and enabling potential side-channel attacks depending on FPU config. The issue has been fixed ...

openSUSE: Security Advisory for mozilla-nss (openSUSE-SU-2020:0953-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0955-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

OPENSUSE-SU-2020:0953-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation bsc1173032 - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony...

Security update for mozilla-nss (moderate)

openSUSE Security Update: Security update for mozilla-nss Announcement ID: openSUSE-SU-2020:0955-1 Rating: moderate References: 1168669 1173032 Cross-References: CVE-2020-12402 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability and has one errata is now available...