Potential Insufficient Entropy Vulnerability in ZF1

More info at https://framework.zend.com/security/advisory/ZF2016-01...

DEBIAN-CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

CVE-2016-2858

CVE-2016-2858 – QEMU PRNG back-end: Local guest OS users can trigger a denial of service by requesting entropy, causing arbitrary stack-based allocations and memory corruption. The issue is specific to builds with PRNG back-end support and results in a QEMU process crash. Connected documents conf...

CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

UBUNTU-CVE-2016-2858

QEMU, when built with the Pseudo Random Number Generator PRNG back-end support, allows local guest OS users to cause a denial of service process crash via an entropy request, which triggers arbitrary stack based allocation and memory corruption...

PT-2016-5245 · Qemu +3 · Qemu +3

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: The issue allows local guest OS users to cause a denial of service, resulting in a process crash. This occurs when an entropy request is made, triggering arbitrary stack-based allocation and...

Timing Attack

Overview Affected versions of csrf-lite are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character...

Insecure Entropy Source - Math.random()

Overview Affected versions of node-uuid consistently fall back to using Math.random as an entropy source instead of crypto, which may result in guessable UUID's. Recommendation Update to version 1.4.4 or later. References - Issue 108 - Issue 122 - GitHub Advisory...

Uber: Estimation of a Lower Bound on Number of Uber Drivers via Enumeration

@ddworken discovered a way to estimate a lower bound on the number of Uber drivers via an endpoint with low entropy. Thanks for the report @ddworken! Good summary from @Uber, just wanted to clarify that we are sticking to limited disclosure since this issue was only patched moving forward so not...

QEMU Denial of Service Vulnerability (CNVD-2016-01541)

QEMU is a simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. QEMU has a security vulnerability. Due to an error in the program's handling of requests for random number generation entropy. A local attacker exploited the...

Firmware Analysis Tool: Binwalk

Binwalk is a fast, easy to use tool for analyzing and extracting firmware images Firmware Analysis Tool Binwalk is: Fast Flexible Extendable Easy to use Binwalk can: Find and extract interesting files / data from binary images Find and extract raw compression streams Identify opcodes for a variet...

Zend Framework CAPTCHA Challenge Insufficient Entropy Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. An insufficient entropy vulnerability exists in ZF. An attacker can exploit this vulnerability to obtain sensitive...

Design/Logic Flaw

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

CVE-2015-6418

CVE-2015-6418 concerns Cisco Small Business RV Series routers (4.x) and SA500 Security Appliances (2.2.07). The root cause is a weak random-number generator with insufficient entropy used during TLS handshake key exchange, enabling a remote attacker to potentially determine the TLS key pair from ...

CVE-2015-6418

The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

Potential Information Disclosure and Insufficient Entropy vulnerability in Zend\Captcha\Word

More info at https://framework.zend.com/security/advisory/ZF2015-09...

USN-2709-2 pollinate update

USN-2709-1 updated pollinate's certificate for entropy.ubuntu.com but did not include a new certificate authority certificate. This update fixes the problem. We apologize for the inconvenience. Original advisory details: The pollinate package bundles the certificate for entropy.ubuntu.com. This...

PE Static Malware Analysis: PortEx

PortEx is a Java library for static malware analysis of portable executable files. Its focus is on PE malformation robustness and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading Header information from: MSDOS Header, COFF File Header,...