DEBIAN-CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

Design/Logic Flaw

DISPUTED The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an...

CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining CBC malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL...

CVE-2017-17688

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

CVE-2017-17689

CVE-2017-17689 arises from S/MIME CBC gadget attacks (EFAIL) that can lead to plaintext exfiltration. Connected sources show this affecting KDE PIM/KMail components and related mail tooling across Linux/macOS ecosystems, with public advisories describing how S/MIME/CBC malleability could leak pla...

CVE-2017-17688

CVE-2017-17688 concerns an OpenPGP CFB gadget/malleability attack (EFAIL) that can lead to plaintext exfiltration from encrypted emails. Connected advisories show Enigmail/OpenPGP patches (e.g., openSUSE SUSE/OpenSUSE-2019-368/395; Thunderbird enigmail updates) addressing this vulnerability by ti...

CVE-2017-17688

Removed by vendor...

CVE-2017-17688: Undefined Security Weakness

The OpenPGP specification allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code MDC feature or accept an obsolete...

CVE-2017-17689: Undefined Security Weakness

The S/MIME specification allows a Cipher Block Chaining CBC malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL...

PT-2018-6547

Name of the Vulnerable Software and Affected Versions: S/MIME affected versions not specified Description: The issue concerns a Cipher Block Chaining CBC malleability-gadget attack, which can indirectly lead to plaintext exfiltration. Recommendations: At the moment, there is no information about ...

PT-2018-6546 · Openpgp +1 · Openpgp +1

Name of the Vulnerable Software and Affected Versions: OpenPGP affected versions not specified Description: The issue allows a Cipher Feedback Mode CFB malleability-gadget attack that can indirectly lead to plaintext exfiltration. This is reportedly a problem in applications that mishandle the...

CVE-2017-17689

The S/MIME specification allows a Cipher Block Chaining CBC malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. Mitigation The easiest way to mitigate this vulnerability is not to use HTML emails. If you really need to use them ensure that MUA clients disable...

Google Nexus Synaptics Touchscreen Firmware Injection(CVE-2017-0433)

Products Nexus 6P Nexus 9 Android One Pixel Pixel XL Vulnerable Versions Verified on Nexus 9 6.0.1/MOB30W Verified on Nexus 9 7.0/NRD90M Technical Details Due to lenient SELinux and DAC policy, vulnerable Synaptics DSX touchscreen driver sysfs file entires are exposed to an attacker that executes...

The vulnerability of Google Chrome browser allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library used by Google Chrome’s browser, due to incorrect processing of ASN.1 values in X.509 certificates. Exploiting this vulnerability allows malicious actors to replace RSA signatures with specially crafted certificates. This...

The vulnerability of Thunderbird software, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library of Mozilla, applicable to Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla SeaMonkey, Google Chrome, and Google Chrome OS. It stems from improper handling of ASN.1 values in X.509 certificates. Exploiting this...

The vulnerability of the Firefox browser, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library of Mozilla for Mozilla Firefox, due to incorrect processing of ASN.1 values in X.509 certificates. Exploiting this vulnerability allows malicious actors to replace RSA signatures with specially crafted certificates. This...

The vulnerability in the Firefox ESR software allows a malicious individual to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library of Mozilla for Mozilla Firefox ESR due to incorrect processing of ASN.1 values in X.509 certificates. Exploiting this vulnerability allows malicious actors to replace RSA signatures with specially crafted certificates. This...

The vulnerability of the SeaMonkey software allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability exists in the NSS Network Security Services library of Mozilla, applicable to Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla SeaMonkey, Google Chrome, and Google Chrome OS. It stems from improper handling of ASN.1 values in X.509 certificates. Exploiting this...

Mandriva Linux Security Advisory : nss (MDVSA-2015:059)

Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages : The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an...