MGASA-2017-0307 Updated libice packages fix security vulnerability

libICE depends on arc4random to generate the session cookies, thereby using a weak mechanism to generate entropy CVE-2017-2626...

CentOS 7 : libICE / libX11 / libXaw / libXcursor / libXdmcp / libXfixes / libXfont / libXfont2 / etc (CESA-2017:1865)

An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

Scientific Linux Security Update : X.org X11 libraries on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: libX11 1.6.5, libXaw 1.0.13, libXdmcp 1.1.2, libXfixes 5.0.3, libXfont 1.5.2, libXi 1.7.9, libXpm 3.5.12, libXrandr 1.5.1, libXrender 0.9.10, libXt 1.1.5, libXtst 1.2.3, libXv 1.0.11, libXvMC 1.0.10, libXxf86vm 1.1.4, libdrm...

PYSEC-2017-50

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

CVE-2015-7764

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

Code injection

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

CVE-2015-3405

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

CVE-2015-3405

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

DEBIAN-CVE-2015-3405

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

UBUNTU-CVE-2015-3405

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

PYSEC-2017-50

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

CVE-2015-3405

ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not , which might allow remote attackers to obtain the value of generated MD5...

CVE-2015-7764

Affected software: Lemur 0.1.4 (Python-based TLS certificate management tool). Issue: does not use sufficient entropy in its IV when encrypting AES in CBC mode, due to improper IV generation. This underlying cause can weaken confidentiality of CBC-encrypted data. Consequence (per sources): primar...

CVE-2015-7764

Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode...

RedHat Update for X.org X11 libraries RHSA-2017:1865-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libICE: weak entropy usage in session keys

It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list...

libXdmcp: weak entropy usage for session keys

It was discovered that libXdmcp used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions...

Moderate: Red Hat Security Advisory: X.org X11 libraries security, bug fix and enhancement update

An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links ...

openSUSE Security Update : xorg-x11-server (openSUSE-2017-826)

This update for xorg-x11-server fixes the following issues : - Improve retrieval of entropy for generating random authentication cookies bsc1025084 - Fix rendering with glamor acceleration. bsc1047154 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

SUSE SLES11 Security Update : xorg-x11-libXdmcp (SUSE-SU-2017:1868-1)

This update for xorg-x11-libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046 Note that Tenable Network Security has extracted the preceding description block directl...