Privilege escalation

An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions:...

Information disclosure

An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android...

CVE-2017-0626

CVE-2017-0626 is an information-disclosure vulnerability in the Qualcomm crypto engine driver, affecting Android kernel components (Kernel-3.10 and Kernel-3.18). A local malicious app could access data outside its permission levels due to this driver flaw. Evidence shows affected product as Andro...

CVE-2016-10289

An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions:...

CVE-2016-10289

CVE-2016-10289 is an elevation-of-privilege in the Qualcomm crypto driver that could allow a local malicious app to run arbitrary code in the kernel. Affected: Android devices using Kernel-3.10/3.18; impact described as high since exploitation requires a privileged process, plus user interaction ...

CVE-2017-0626

An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android...

Google Android Qualcomm crypto engine driver information disclosure vulnerability

Androidon Nexus5X etc. is a set of open source operating system running on Nexus5X etc. smart devices and based on Linux, which is jointly developed by Google and the Open Handheld Alliance OHA.Qualcomm crypto engine driver is one of the... Qualcomm crypto engine driver. An information disclosure...

Cookie leakage to wrong origins and non-restricted cookie acceptance

Security and maintenance release. - Security: Previously cookies of foo.bar.example.com were leaked to foo.bar. Additionally, any site could set cookies for any other site. Artax follows newer browser implementations now. Cookies can only be set on domains higher or equal to the current domain, b...

USN-3279-1 apache2 vulnerabilities

It was discovered that the Apache modsessioncrypto module was encrypting data and cookies using either CBC or ECB modes. A remote attacker could possibly use this issue to perform padding oracle attacks. CVE-2016-0736 Maksim Malyutin discovered that the Apache modauthdigest module incorrectly...

Google Android Qualcomm crypto driver elevation of privilege vulnerability

Google Android is a Linux-based operating system for smartphone devices. An elevation of privilege vulnerability exists in the Google Android Qualcomm crypto driver, which can be exploited by a remote attacker to build a malicious application that can be elevated in privilege by inducing a user t...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of NVIDIA’s Android crypto operating system driver is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Linux operating system, which allows a perpetrator to trigger a service failure or cause other effects.

The vulnerability in the Linux operating system’s crypto/ccm.c driver arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a local attacker to improperly interact with the CONFIGVMAPSTACK parameter, resulting in a service failure system...

Private CRT-based RSA Key Leakage

crypto/rsa in github.com/golang/go is vulnerable to private CRT-based RSA key leakage. The leakage happens due to an error in the CRT computation. And it fails to check RSA signature to prevent the error...

Man-in-the-middle (MitM)

github.com/golang/crypto is vulnerable to man-in-the-middle MitM attacks. The HostKeyCallback function currently interprets nil as to accept any host keys. A MitM server can allow the login to succeed and get the agemt to authenticate to the actual server...

Denial Of Service (DoS)

crypto/dsa in github.com/golang/go is vulnerable to denial of service DoS attacks. These attacks are possible due to a flaw in the Verify function in crypto/dsa/dsa.go. It doesn't properly check parameters passed to the big integer library. This flaw can be exploited through a a public key given ...

[SECURITY] Fedora 24 Update: bouncycastle-1.52-9.fc24

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organized so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE...

Linux kernel denial of service vulnerability (CNVD-2017-05879)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the crypto/ccm.c file in Linux kernel versions 4.10.x prior to 4.10.12 and 4.9.x. The vulnerability can be exploited by a local...

CVE-2017-8065

CVE-2017-8065 affects the Linux kernel (4.9.x and 4.10.x up to 4.10.12). The issue arises from how crypto/ccm.c interacts with CONFIG_VMAP_STACK, enabling a local attacker to cause a denial of service (system crash or memory corruption) by leveraging use of more than one virtual page for a DMA sc...

CVE-2017-6615

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a race condition that could occur when the affected software processes an SNMP read...

Race condition

A vulnerability in the Simple Network Management Protocol SNMP subsystem of Cisco IOS XE 3.16 could allow an authenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a race condition that could occur when the affected software processes an SNMP read...