MGASA-2016-0156 Updated php-ZendFramework packages fix security vulnerability

The php-ZendFramework package has been updated to version 1.12.18 to fix a potential information disclosure and insufficient entropy vulnerability in the word CAPTCHA ZF2015-09 and several other functions ZF2016-01...

Juniper Networks QFX5100 and QFX10002 Security Bypass Vulnerability

The Juniper Networks QFX5100 and QFX10002 are switch products from Juniper Networks, Inc. The Juniper Networks QFX5100 and QFX10002 use insufficient entropy, allowing remote attackers to exploit the vulnerability to affect system mechanisms and bypass security restrictions...

CVE-2016-1273

Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors...

CVE-2016-1273

Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors...

Authentication flaw

Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors...

Potential Insufficient Entropy Vulnerability in ZF1

More info at https://framework.zend.com/security/advisory/ZF2016-01...

DEBIAN-CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

CVE-2016-2858

CVE-2016-2858 – QEMU PRNG back-end: Local guest OS users can trigger a denial of service by requesting entropy, causing arbitrary stack-based allocations and memory corruption. The issue is specific to builds with PRNG back-end support and results in a QEMU process crash. Connected documents conf...

CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

UBUNTU-CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

PT-2016-5245 · Qemu +3 · Qemu +3

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue allows local guest OS users to cause a denial of service, resulting in a process crash. This occurs when an entropy request is made, triggering arbitrary stack-based allocation and...

Timing Attack

Overview Affected versions of csrf-lite are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character...

Insecure Entropy Source - Math.random()

Overview Affected versions of node-uuid consistently fall back to using Math.random as an entropy source instead of crypto, which may result in guessable UUID's. Recommendation Update to version 1.4.4 or later. References - Issue 108 - Issue 122 - GitHub Advisory...

Uber: Estimation of a Lower Bound on Number of Uber Drivers via Enumeration

@ddworken discovered a way to estimate a lower bound on the number of Uber drivers via an endpoint with low entropy. Thanks for the report @ddworken! Good summary from @Uber, just wanted to clarify that we are sticking to limited disclosure since this issue was only patched moving forward so not...

QEMU Denial of Service Vulnerability (CNVD-2016-01541)

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. QEMU has a security vulnerability. Due to an error in the program's handling of requests for random number generation entropy. A local attacker exploited the...

Firmware Analysis Tool: Binwalk

Binwalk is a fast, easy to use tool for analyzing and extracting firmware images Firmware Analysis Tool Binwalk is: Fast Flexible Extendable Easy to use Binwalk can: Find and extract interesting files / data from binary images Find and extract raw compression streams Identify opcodes for a variet...

Zend Framework CAPTCHA Challenge Insufficient Entropy Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An insufficient entropy vulnerability exists in ZF. An attacker can exploit this vulnerability to obtain sensitive...

Design/Logic Flaw

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

CVE-2015-6418

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

CVE-2015-6418

CVE-2015-6418 concerns Cisco Small Business RV Series routers (4.x) and SA500 Security Appliances (2.2.07). The root cause is a weak random-number generator with insufficient entropy used during TLS handshake key exchange, enabling a remote attacker to potentially determine the TLS key pair from ...