CVE-2011-3152

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

Directory traversal

DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade...

CVE-2011-3152

CVE-2011-3152 affects Ubuntu Update Manager before certain versions of DistUpgradeFetcherCore.py (before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5) on Ubuntu 8.04–11.10. The flaw is improper verificat...

[ MDVSA-2014:063 ] x2goserver

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:063 http://www.mandriva.com/en/support/security/ Package : x2goserver Date : March 17, 2014 Affected: Business Server 1.0 Problem Description: Updated x2goserver package fixes security vulnerability: A...

USN-2147-1: Mutt vulnerability

Beatrice Torracca and Evgeni Golov discovered a buffer overflow in mutt while expanding addresses when parsing email headers. An attacker could specially craft an email to cause mutt to crash, resulting in a denial of service, or possibly execute arbitrary code with the privileges of the user...

CVE-2013-6952

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

Hardcoded credentials

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

CVE-2013-6952

The CVE-2013-6952 issue affects Belkin WeMo Home Automation firmware prior to 3949, which contains a hardcoded GPG key that could allow remote attackers to sign a malicious firmware update and execute arbitrary code via crafted signed data. Impact described across sources indicates potential remo...

CVE-2013-6952

The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data...

[SECURITY] Fedora 19 Update: python-gnupg-0.3.6-1.fc19

GnuPG bindings for python. This uses the gpg command...

[ MDVSA-2014:035 ] libpng

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:035 http://www.mandriva.com/en/support/security/ Package : libpng Date : February 17, 2014 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated libpng and libpng12 packages fix...

RedHat Update for gnupg RHSA-2014:0016-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ MDVSA-2013:275 ] krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:275 http://www.mandriva.com/en/support/security/ Package : krb5 Date : November 21, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 Problem Description: Updated krb5 package fixes security...

CVE-2013-3704

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a...

CVE-2013-3704

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a...

CVE-2013-3704

The RPM GPG key import and handling feature in libzypp 12.15.0 and earlier reports a different key fingerprint than the one used to sign a repository when multiple key blobs are used, which might allow remote attackers to trick users into believing that the repository was signed by a...

CVE-2013-3704

CVE-2013-3704 affects the RPM GPG key import/handling in libzypp up to version 12.15.0. When multiple key blobs are used, the signature fingerprint presented to users could differ from the repository’s actual signing key, potentially enabling an attacker to mislead users into trusting a signed re...

Mandriva Linux Security Advisory : gnupg (MDVSA-2013:247)

Multiple vulnerabilities has been discovered and corrected in gnupg : GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared no usage permitted as if it has all bits set all usage permitted, which might allow remote attackers to bypass intended cryptographic protection...

Updated gnupg packages fix CVE-2013-4402

Updated gnupg package fixes security vulnerability: Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum CVE-2013-4402...

Updated gnupg2 packages fix multiple vulnerabilities

Updated gnupg2 package fixes security vulnerabilities: RFC 4880 permits OpenPGP keyholders to mark their primary keys and subkeys with a "key flags" packet that indicates the capabilities of the key. These are represented as a set of binary flags, including things like "This key may be used to...