GHSA-XRX6-FMXQ-RJJ2 Timing attacks in python-rsa

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA...

Ruby: imap: StartTLS stripping attack (CVE-2016-0772).

net/imap does not seem to raise an exception when the remote end imap server fails to respond with taggedresponse NO/BAD or OK to an explicit call of imap.starttls. This may allow a malicious MITM to perform a starttls stripping attack if the client code does not explicitly set usessl = true on...

nss: TLS 1.3 CCS flood remote DoS Attack

A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability...

OPENSUSE-SU-2021:0606-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2021-20309: Division by zero in WaveImage of MagickCore/visual-effects. bsc1184624 - CVE-2021-20311: Division by zero in sRGBTransformImage in MagickCore/colorspace.c bsc1184626 - CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage...

PT-2021-5860

Name of the Vulnerable Software and Affected Versions libcurl versions 7.61.0 through 7.76.1 Description The issue is related to the implementation of the Transport Layer Security TLS protocol in the libcurl library, specifically with errors in security settings when using the CURLOPT SSL CIPHER...

curl: CVE-2021-22897: schannel cipher selection surprise

Summary: Commit "schannel: support selecting ciphers" added support for selecting the ciphers with SCHANNEL. However, due to use of a static algIds array for ciphers in setsslciphers the last configured cipher list will override configuration used by other connections, leading to potential wrong...

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2021:1276-1)

This update for ImageMagick fixes the following issues : CVE-2021-20309: Division by zero in WaveImage of MagickCore/visual-effects. bsc1184624 CVE-2021-20311: Division by zero in sRGBTransformImage in MagickCore/colorspace.c bsc1184626 CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage of...

SUSE SLES12 Security Update : ImageMagick (SUSE-SU-2021:1277-1)

This update for ImageMagick fixes the following issues : CVE-2021-20309: Division by zero in WaveImage of MagickCore/visual-effects. bsc1184624 CVE-2021-20311: Division by zero in sRGBTransformImage in MagickCore/colorspace.c bsc1184626 CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage of...

SUSE-SU-2021:1277-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2021-20309: Division by zero in WaveImage of MagickCore/visual-effects. bsc1184624 - CVE-2021-20311: Division by zero in sRGBTransformImage in MagickCore/colorspace.c bsc1184626 - CVE-2021-20312: Integer overflow in WriteTHUMBNAILImage...

SUSE: Security Advisory (SUSE-SU-2015:2088-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2015:2088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-18221 · Unknown · Jose-Node-Cjs-Runtime

Name of the Vulnerable Software and Affected Versions: jose-node-cjs-runtime versions prior to 3.11.4 Description: The AES CBC HMAC SHA2 Algorithm decryption in the jose-node-cjs-runtime package has a timing difference when a padding error occurs, creating a padding oracle. This allows an adversa...

PT-2021-18220 · Unknown · Jose-Node-Esm-Runtime

Name of the Vulnerable Software and Affected Versions: jose-node-esm-runtime versions prior to 3.11.4 Description: The AES CBC HMAC SHA2 Algorithm decryption in the jose-node-esm-runtime package has a timing difference when a padding error occurs, creating a padding oracle. This allows an adversa...

PT-2021-28204

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, as indicated by the crash type. The crash state involves several functions, including load u32 be,...

OSV-2021-616 Heap-buffer-overflow in Camellia_Ekeygen

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33028 Crash type: Heap-buffer-overflow READ 1 Crash state: CamelliaEkeygen Camelliasetkey cipherhwcamelliainitkey...

PT-2021-28195

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details include the involvement of specific functions such as ossl aria set encrypt...

PT-2021-28196

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves several function calls, including DES set key unchecked, oss...

PT-2021-28197

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state involves several functions, includi...

cryptofuzz:cryptofuzz-openssl-noasm: Heap-buffer-overflow in ossl_aria_set_encrypt_key

Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=4610363258699776 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-openssl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow REA...

CVE-2021-20313

A flaw was found in ImageMagick. A potential cipher leak when the calculate signatures in TransformSignature is possible. The highest threat from this vulnerability is to data confidentiality...