libXdmcp: weak entropy usage for session keys

It was discovered that libXdmcp used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions...

libICE: weak entropy usage in session keys

It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...

Moderate: Red Hat Security Advisory: X.org X11 libraries security, bug fix and enhancement update

An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

openSUSE Security Update : xorg-x11-server (openSUSE-2017-825)

This update for xorg-x11-server fixes the following issues : - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize...

openSUSE Security Update : xorg-x11-server (openSUSE-2017-826)

This update for xorg-x11-server fixes the following issues : - Improve retrieval of entropy for generating random authentication cookies bsc1025084 - Fix rendering with glamor acceleration. bsc1047154 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

SUSE SLES11 Security Update : xorg-x11-libXdmcp (SUSE-SU-2017:1868-1)

This update for xorg-x11-libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046 Note that Tenable Network Security has extracted the preceding description block directl...

SUSE SLED12 / SLES12 Security Update : libXdmcp (SUSE-SU-2017:1862-1)

This update for libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046 Note that Tenable Network Security has extracted the preceding description block directly from th...

openSUSE: Security Advisory for xorg-x11-server (openSUSE-SU-2017:1885-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for xorg-x11-server (important)

This update for xorg-x11-server fixes the following issues: - CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. bnc1035283 - Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the allowed range. - CVE-2017-10972: Initialize t...

SUSE-SU-2017:1868-1 Security update for xorg-x11-libXdmcp

This update for xorg-x11-libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046...

SUSE-SU-2017:1862-1 Security update for libXdmcp

This update for libXdmcp fixes the following issues: - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046...

SA153: NSS Vulnerabilities Apr-May 2017

SUMMARY Symantec Network Protection products using affected versions of NSS are susceptible to two security vulnerabilities. A remote attacker can send empty SSLv2 messages and cause denial of service through application crashes. An attacker can also have unspecified impact by exploiting a...

openSUSE Security Update : libXdmcp (openSUSE-2017-789)

This update for libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable boo1025046 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

Remote code execution

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...

Unsafe Signing Using A Broken Entropy Sources

crypto/ecdsa in github.com/golang/go is vulnerable to unsafe signing. It can happen because it uses a signing key generated using a broken entropy of rand...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

Truehunter - Tool to detect TrueCrypt containers

The goal of Truehunter is to detect TrueCrypt containers using a fast and memory efficient approach. It was designed as a PoC some time ago as I couldn't find any open source tool with the same functionality. Installation Just use with Python 2.7, it does not need any additional libraries. usage:...

libXdmcp -- insufficient entropy generating session keys

The freedesktop and x.org project reports: It was discovered that libXdmcp before 1.1.3 used weak entropy to generate session keys on platforms without arc4randombuf but with getentropy. On a multi-user system using xdmcp, a local attacker could potentially use information available from the...