9691 matches found
Debian Security Advisory DSA 3901-1 (libgcrypt20 - security update)
Daniel J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Tanja Lange, Christine van Vredendaal and Yuval Yarom discovered that Libgcrypt is prone to a local side-channel attack allowing full key recovery for RSA-1024. See https://eprint.iacr.org/2017/627 for...
The vulnerability of the Linux operating system, which allows a hacker to trigger a service failure
The vulnerability of the cryptographic list of the Linux operating system’s kernel API interface is related to resource management errors. Exploiting this vulnerability could allow a local attacker to trigger a service failure system crash or memory corruption due to improper interaction with the...
The vulnerability of the crypto/ahash.c component in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the crypto/ahash.c component in the Linux operating system is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability allows a remote attacker to cause a service failure the API interface calls its own callback and triggers infinit...
Threat Round-up for June 16 - June 23
Today, Talos is publishing a glimpse into the most prevalent threats we've observed between June 16 and June 23. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics,...
The vulnerability of the hw/virtio/virtio-crypto.c component of the QEMU hardware emulation driver allows a attacker to trigger a service failure or execute arbitrary code.
The vulnerability of the hw/virtio/virtio-crypto.c component of the QEMU hardware emulation software is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker acting locally to cause a service failure abrupt process termination or execute arbitrary code using a...
Unsafe Signing Using A Broken Entropy Sources
crypto/ecdsa in github.com/golang/go is vulnerable to unsafe signing. It can happen because it uses a signing key generated using a broken entropy of rand...
Missing Certificate Request Signature Validation
crypto/x509 in github.com/golang/go is missing certificate request signature validation. The library does not check the binding of the private key i.e., signature validation to its corresponding entities' certificate...
Remote Symbol Resolution
Introduction The following blog discusses a couple of common techniques that malware uses to obscure its access to the Windows API. In both forms examined, analysts must calculate the API start address and resolve the symbol from the runtime process in order to determine functionality. After...
MGASA-2017-0175 Updated libcryptopp packages fix security vulnerability
Crypto++'s Zinflate class, used by classes like Gunzip and Inflator, could perform an out-of-bounds read when decompressing data CVE-2017-9434...
Updated libcryptopp packages fix security vulnerability
Crypto++'s Zinflate class, used by classes like Gunzip and Inflator, could perform an out-of-bounds read when decompressing data CVE-2017-9434...
[SECURITY] Fedora 26 Update: libgcrypt-1.7.7-1.fc26
Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...
Crypto++ Out-of-Bounds Read Vulnerability
Crypto++ aka cryptopp is a free C++ library. An out-of-bounds read vulnerability exists in the zinflate.cpp file of the Inflator filter in Crypto++ 5.6.5 and earlier. An attacker can exploit this vulnerability to cause a denial of service...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...
httpd: Padding Oracle in Apache mod_session_crypto
It was discovered that the modsessioncrypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack...
Copy-Paste Vulnerability (CVE) Denial Of Service (DoS)
CryptoppECC contains a copy of the Crypto++ aka cryptopp and libcrypto++ library inside it. The version that it contains is vulnerable to a denial of service DoS attack through the mishandling of the ASN1 encoding. Crypto++ allocates a SecByteBlock of the size that the ASN1 decoder reads as the...
Design/Logic Flaw
Crypto++ aka cryptopp through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter...
CVE-2017-9434
Crypto++ aka cryptopp through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter...
CVE-2017-9434
Crypto++ aka cryptopp through 5.6.5 contains an out-of-bounds read vulnerability in zinflate.cpp in the Inflator filter...