MGASA-2018-0339 Updated libtomcrypt packages fix security vulnerability

libtomcrypt has been updated to secure it against two security vulnerabilities. A problem in the ASN.1 parser could cause a stack overflow and a resulting denial of service when parsing deeply recursive ASN.1 types CVE-2018-0739. An attacker capable of triggering signatures and mounting a side...

BoringSSL ROHNP Vulnerability

BoringSSL is a branch library of OpenSSL used to implement encryption and TLS functionality in Google products. A security vulnerability exists in BoringSSL versions 2018-06-14 and earlier. An attacker can exploit the vulnerability to obtain a DSA key by accessing a local device or a different...

MOXA EDS-G512E Public and Private Key Extraction Vulnerability

The MOXA EDS-G512E is a Gigabit Ethernet managed switch. A public and private key extraction vulnerability exists in MOXA EDS-G512E 5.1 build 16072215. An attacker can exploit this vulnerability to extract the public and private keys from the firmware image available on the MOXA website and use...

Code injection

Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key KNETI and impersonate the nShield Connect device on a network, affect...

CVE-2015-1878

Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key KNETI and impersonate the nShield Connect device on a network, affect...

CVE-2015-1878

The CVE-2015-1878 case affects Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ prior to version 11.72. The issue arises when a physically proximate attacker connects via the front-panel USB port to sign arbitrary data with previously loaded signing keys, extract the...

Automated Android Malware Analysis: CuckooDroid

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files. CuckooDroid brigs to cuckoo the capabilities of execution and analysis of android application. CuckooDroid is an automated, cross-platform, emulation and analysis framework based on...

CVE-2017-6076

CVE-2017-6076 affects wolfSSL prior to 3.10.2, where the fp_mul_comba function can enable a local attacker with access to a machine’s cache view to extract RSA key information. The vulnerability is a local confidentiality issue (HIGH impact per the CVE/NVD data) resulting from this specific multi...

CVE-2017-6076

In versions of wolfSSL before 3.10.2 the function fpmulcomba makes it easier to extract RSA key information for a malicious user who has access to view cache on a machine...

How to Crack Android Full Disk Encryption on Qualcomm Devices

The heated battle between Apple and the FBI provoked a lot of talk about Encryption – the technology that has been used to keep all your bits and bytes as safe as possible. We can not say a lot about Apple's users, but Android users are at severe risk when it comes to encryption of their personal...

The vulnerability of the OpenSSL library, which allows a hacker to compromise RSA keys

The vulnerability of the MODEXPCTIMECOPYFROMPREBUF function crypto/bn/bnexp.c in the OpenSSL library is related to the lack of protection for service data. Exploiting this vulnerability could allow a local attacker to extract RSA keys by running a specially created application...

libgcrypt: secret key extraction

A vulnerability was found in a way the ECDH encryption algorithm decrypts data. An attacker with a specialized setup can extract the secret decryption key from a target located in an adjacent room within seconds. This is done by measuring the target's electromagnetic emanations...

Amazon Linux AMI : libgcrypt (ALAS-2015-577)

Fix a side-channel attack on data-dependent timing variations in modular exponentiation, which can potentially lead to an information leak. CVE-2015-0837 Fix a side-channel attack which can potentially lead to an information leak. CVE-2014-3591 Libgcrypt before 1.5.4, as used in GnuPG and other...

CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

DEBIAN-CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

Code injection

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...

CVE-2014-5270

Libgcrypt prior to 1.5.4, used in GnuPG and other products, has a weakness in ciphertext normalization and ciphertext randomization. This side-channel condition could allow physically proximate attackers to perform key-extraction attacks by collecting voltage data from exposed metal. The CVE entr...

CVE-2014-5270

Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed...