CVE-2016-2850

Botan 1.11.x before 1.11.29 does not enforce TLS policy for 1 signature algorithms and 2 ECC curves, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

[SECURITY] [DSA 3565-1] botan1.10 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3565-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 02, 2016 https://www.debian.org/security/faq -...

DSA-3565-1 botan1.10 - security update

Bulletin has no description...

Debian Security Advisory DSA 3565-1 (botan1.10 - security update)

Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, including encryption, authentication, X.509v3 certificates and CRLs. CVE-2015-5726 The BER decoder would crash due to reading from offset 0 of an empty vector i...

[SECURITY] [DLA 449-1] botan1.10 security update

Package : botan1.10 Version : 1.10.5-1+deb7u1 CVE ID : CVE-2014-9742 CVE-2015-5726 CVE-2015-5727 CVE-2015-7827 CVE-2016-2194 CVE-2016-2195 CVE-2016-2849 Several security vulnerabilities were found in botan1.10, a C++ library which provides support for many common cryptographic operations, includi...

FreeBSD : Multiple vulnerabilities in Botan (4cd9b19f-f66d-11e5-b94c-001999f8d30b)

The botan developers reports : Infinite loop in modular square root algorithm - The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided,...

The vulnerability of Nettle’s cryptographic library allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ecc256modp function in the Nettle cryptographic library is related to errors in cryptographic transformations. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

openSUSE Security Update : dropbear (openSUSE-2016-387)

dropbear was updated to 2016.72 to fix the following issues : Changes in dropbear : - updated to upstream version 2016.72 - Validate X11 forwarding input. Could allow bypass of authorizedkeys command= restrictions, found by github.com/tintinweb. Thanks for Damien Miller for a patch. - used as bug...

botan: multiple issues

CVE-2016-2849 ECDSA side channel: ECDSA and DSA signature algorithms perform a modular inverse on the signature nonce k. The modular inverse algorithm used had input dependent loops, and it is possible a side channel attack could recover sufficient information about the nonce to eventually...

MGASA-2016-0102 Updated botan packages fix security vulnerability

The BER decoder would crash due to reading from offset 0 of an empty vector if it encountered a BIT STRING which did not contain any data at all. This can be used to easily crash applicatons reading untrusted ASN.1 data, but does not seem exploitable for code execution CVE-2015-5726. The BER...

Fedora 21 : firefox-42.0-2.fc21 / nspr-4.10.10-1.fc21 / nss-3.20.1-1.0.fc21 / etc (2015-fb3360fc0a)

firefox-42.0-2.fc22 - Update to 42.0 firefox-42.0-2.fc21 - Update to 42.0 firefox-42.0-2.fc23 - Update to 42.0 nspr-4.10.10-1.fc23 - Update to NSPR41010RTM nspr-4.10.10-1.fc21 - Update to NSPR41010RTM nspr-4.10.10-1.fc22 - Update to NSPR41010RTM ---- firefox-41.0.2-2.fc21 - Update to 41.0.2...

Nettle has an unspecified vulnerability

Nettle is a library of basic cryptographic functions. A security vulnerability exists in the 'ecc256modp' function in the ecc-256.c file in versions prior to Nettle 3.2, which stems from a failure of the program to properly handle rounding transfers when implementing P-256 NIST elliptic curves. A...

CVE-2015-8805

The ecc256modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

Design/Logic Flaw

The ecc256modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

CVE-2015-8803

CVE-2015-8803 affects the nettle library: the ecc_256_modp implementation for P-256 may propagate carries incorrectly in nettle before version 3.2, producing incorrect output and potentially allowing unspecified impact. Multiple Nessus reports and advisories (MiracleLinux AXSA-2016-1108, EulerOS ...

CVE-2015-8805

The ecc256modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

CVE-2015-8803

The ecc256modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...

CVE-2015-8804

x8664/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors...

CVE-2015-8805

Summary. The CVE-2015-8805 issue affects the nettle cryptographic library prior to version 3.2. The vulnerability is in the elliptic-curve implementation for P-256: the ecc_256_modq function in ecc-256.c does not properly handle carry propagation, producing incorrect output. This is documented al...

CVE-2015-8803

The ecc256modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than...