CLSA-2024-1730915716 Update of nss

update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "OISTE WISeKey Global Root GC CA" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of...

CVE-2024-9143 Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-9143

The OpenSSL library is vulnerable to out-of-bounds memory reads or writes due to the use of low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. The affected APIs include EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various BN_GF2m_*() funct...

CVE-2024-9143

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

CVE-2024-21206

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Diagnostics. Supported versions that are affected are ECC:11-13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterpri...

CVE-2024-21206: Observable Discrepancy

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Diagnostics. Supported versions that are affected are ECC:11-13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterpri...

CVE-2024-42098 crypto: ecdh - explicitly zeroize private_key

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize privatekey privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively a newly generated private key. However, it is possible that the caller provides a...

OESA-2024-1679 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for offinddevicebynode Add check for the return value of offinddevicebynode and return the error if it fails in order to avoid...

RHEL 6 : nss (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nss: Check length of inputs for cryptographic primitives CVE-2019-17006 - An existing mitigation of timin...

Microsoft PlayReady Complete Client Identity Compromise

Hello All, We have come up with two attack scenarios that make it possible to extract private ECC keys used by a PlayReady client Windows SW DRM scenario for the communication with a license server and identity purposes. More specifically, we successfully demonstrated the extraction of the...

kernel: drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: disable gfx9 cpeccerrorirq only when enabling legacy gfx ras gfx9 cpeccerrorirq is only enabled when legacy gfx ras is assert. So in gfxv90hwfini, interrupt disablement for cpeccerrorirq should be executed under...

PT-2025-41072

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue related to the handling of error interrupts within the amdgpu driver. Specifically, the gfx v11 0 cp ecc error irq interrupt is retired in the gfx11...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

GHSA-3494-CFWF-56HW mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

CVE-2024-33851

phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. This is related to phpecc/phpecc on GitHub, and the Matyas Danter ECC library...

CVE-2024-33851

phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. This is related to phpecc/phpecc on GitHub, and the Matyas Danter ECC library...

CVE-2024-33851

The phpecc library (specifically as used in paragonie/phpecc before 2.0.1 and mdanter/ecc in all versions) contains a branch-based timing leak during Point addition. This flaw allows an attacker to deduce private keys by measuring the time required to perform cryptographic computations. Remediati...

PT-2024-25510 · Phpecc +1 · Phpecc +2

Name of the Vulnerable Software and Affected Versions: phpecc versions prior to 2.0.1 paragonie/ecc versions prior to 2.0.1 mdanter/ecc all versions Description: The issue is a branch-based timing leak in Point addition. This leak is related to the phpecc/phpecc library on GitHub and the Matyas...

CVE-2024-33851

phpecc, as used in paragonie/phpecc before 2.0.1, has a branch-based timing leak in Point addition. This is related to phpecc/phpecc on GitHub, and the Matyas Danter ECC library...

Information Exposure Through Timing Discrepancy

Overview paragonie/ecc is an Elliptic Curve Cryptography library Affected versions of this package are vulnerable to Information Exposure Through Timing Discrepancy due to the use of the GMPMath adapter, which wraps the GNU Multiple Precision arithmetic library GMP not aiming to provide...