CVE-2014-8564

The gnutlseccansix963export function in gnutlsecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service out-of-bounds write via a crafted 1 Elliptic Curve Cryptography ECC certificate or 2 certificate signing requests CSR,...

openssl security update

1.0.1e-30.2 - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 1.0.1e-30 - add ECC TLS extensions to DTLS 1119800 1.0.1e-29 - fix CVE-2014-3505...

GLSA-201408-03 : LibSSH: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201408-03 LibSSH: Information disclosure A new connection inherits the state of the PRNG without re-seeding with random data. Impact : Servers using ECC ECDSA or DSA certificates in non-deterministic mode may under certain...

LibSSH: Information disclosure

Background LibSSH is a C library providing SSHv2 and SSHv1. Description A new connection inherits the state of the PRNG without re-seeding with random data. Impact Servers using ECC ECDSA or DSA certificates in non-deterministic mode may under certain conditions leak their private key. Workaround...

openSUSE: Security Advisory for security (openSUSE-SU-2014:0969-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : libgcrypt (openSUSE-SU-2013:1294-1)

libgcrypt was updated to 1.5.3 bnc831359 to fix a security issue, bugs and get some new features : Security issue fixed : - Mitigate the Yarom/Falkner flush+reload side-channel attack on RSA secret keys. See . - contains changes from 1.5.2 - The upstream sources now contain the IDEA algorithm,...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:0599-1)

This is a MozillaFirefox update to version 29.0 : - MFSA 2014-34/CVE-2014-1518/CVE-2014-1519 Miscellaneous memory safety hazards - MFSA 2014-36/CVE-2014-1522 bmo995289 Web Audio memory corruption issues - MFSA 2014-37/CVE-2014-1523 bmo969226 Out of bounds read while decoding JPG images - MFSA...

MatrixSSL拒绝服务漏洞

MatrixSSL是针对小型应用程序和设备设计的嵌入式、开放源码SSLv3协议栈（商业版支持TLS协议）。 MatrixSSL中解析ECC密文套件参数和安全重协商的TLS扩展存在多个边界错误，允许攻击者利用漏洞提交特殊请求，触发越界内存访问，造成拒绝服务攻击。 0 MatrixSSL 3.x MatrixSSL 3.6.1版本已修复该漏洞，建议用户下载使用： http://www.matrixssl.org...

Fedora 19 : mingw-gnutls-3.1.21-1.fc19 (2014-2565)

Version 3.1.21 released 2014-02-13 - libgnutls: Tolerate servers that sent the SUPPORTED ECC extension. - libgnutls: Reduced the TLS and DTLS version requirements for all ciphersuites that are not GCM. - libgnutls: When two initial keywords are specified then treat the second as having the '+'...

Fedora 20 : mingw-gnutls-3.1.21-1.fc20 (2014-2583)

Version 3.1.21 released 2014-02-13 - libgnutls: Tolerate servers that sent the SUPPORTED ECC extension. - libgnutls: Reduced the TLS and DTLS version requirements for all ciphersuites that are not GCM. - libgnutls: When two initial keywords are specified then treat the second as having the '+'...

Fedora 19 : mingw-openssl-1.0.1e-5.fc19 (2014-1560)

Synced patches with native openssl-1.0.1e-38.fc21 which fixes various CVE's and also enables ECC support Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

Fedora 20 : mingw-openssl-1.0.1e-5.fc20 (2014-1567)

Synced patches with native openssl-1.0.1e-38.fc21 which fixes various CVE's and also enables ECC support Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

[Harden SSL/TLS] Hardening the SSL/TLS settings

“Harden SSL/TLS” allows hardening the SSL/TLS settings of Windows 2000,2003,2008,2008R2, XP,Vista,7. It allows locally and remotely set SSL policies allowing or denying certain ciphers/hashes or complete ciphersuites. This tool specific allows setting policies with regards to what ciphers and...

ruby security update

1.8.7.352-13 - Workaround build issues against OpenSSL with enabled ECC curves. - Make DRb compatible with OpenSSL 1.0.1. ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing...

Fedora 19 : gnutls-3.1.16-1.fc19 (2013-20628)

Minor security update from upstream. New minor upstream release fixing a security issue. Adds ECC NIST Suite B curves support ECDH, ECDSA Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora 19 : gnutls-3.1.15-1.fc19 (2013-20052)

New minor upstream release fixing a security issue. Adds ECC NIST Suite B curves support ECDH, ECDSA Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

CVE-2013-6284

Unspecified vulnerability in the Statutory Reporting for Insurance FSSR component in the Financial Services module for SAP ERP Central Component ECC allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."...

Code injection

Unspecified vulnerability in the Statutory Reporting for Insurance FSSR component in the Financial Services module for SAP ERP Central Component ECC allows attackers to execute arbitrary code via unspecified vectors, related to a "code injection vulnerability."...

CVE-2013-6284

Technical details (affected products, versions, root cause, or fixes) are not publicly provided in the supplied documents. Monitor for updates.

Experts Urge ECC crytpo over RSA algorithm

LAS VEGAS – Cryptographic breakthroughs have accelerated in the past six months in areas such as discrete logarithm computations that lead experts to believe that breaking the stalwart RSA algorithm may be in the not-too-distant future. A team of crypto experts today at Black Hat USA 2013 present...