1708 matches found
CVE-2019-9155
A cryptographic issue in OpenPGP.js =4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key...
CVE-2019-9153
CVE-2019-9153 affects OpenPGP.js: improper verification of cryptographic signatures in OpenPGP.js up to version 4.1.2 allows forging signed messages by substituting a standalone or timestamp signature. The issue is documented across multiple sources (NVD entry for CVE-2019-9153 and related adviso...
OPENSUSE-SU-2019:1951-1 Recommended update for dkgpg, libTMCG
This update for dkgpg, libTMCG fixes the following issues: libTMCG was updated to version 1.3.18 This release is two-fold: first, it fixes some bugs e.g. iterated S2K of the OpenPGP interface, and second, it adds functionality for handling v5 keys and signatures see RFC 4880bis-07. Update to...
PT-2019-20094
Name of the Vulnerable Software and Affected Versions dkgpg versions prior to 1.1.3 libTMCG versions prior to 1.3.18 Description The issue is related to updates for dkgpg and libTMCG, which fix several bugs and add new functionality for handling v5 keys and signatures. The updates also enhance th...
Recommended update for dkgpg, libTMCG (moderate)
openSUSE Security Update: Recommended update for dkgpg, libTMCG Announcement ID: openSUSE-SU-2019:1951-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that contains security fixes can now be installed. Description: This update for dkgpg, libTMCG...
NewStart CGSL MAIN 4.05 : gnutls Multiple Vulnerabilities (NS-SA-2019-0109)
The remote NewStart CGSL host, running version MAIN 4.05, has gnutls packages installed that are affected by multiple vulnerabilities: - Stack-based buffer overflow in the cdkpkgetkeyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have...
[SECURITY] Fedora 29 Update: gnupg2-2.2.17-1.fc29
GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...
PHKP 'pgp_exec()' function command injection vulnerability
PHKP is a PHP-based implementation of the OpenPGP HTTP secret key server protocol. A command injection vulnerability exists in the 'pgpexec' function of the phkp.php file in PHKP. The vulnerability stems from a network system or product not properly filtering special elements of externally entere...
Fedora Update for gnupg2 FEDORA-2019-2f259a6c0a
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 30 Update: gnupg2-2.2.17-1.fc30
GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...
A week in security (July 1 – 7)
Last week on Malwarebytes Labs, we explained what to do when you find stalkerware, how cooperating apps and automatic permissions are setting you up for failure, and why you should steer clear of Bitcoin Cash generators. Other cybersecurity news: A former Chief Information Officer CIO of Equifax...
PGP Ecosystem Targeted in ‘Poisoning’ Attacks
A long-feared attack vector used against Pretty Good Privacy, the framework used to authenticate and keep email messages private, is being exploited for the first time. The attack, which takes aim at keyserver verification directories, makes it impossible for Pretty Good Privacy PGP to work...
Man-in-the-Middle (MitM)
openpgp is vulnerable to man-in-the-middle MitM attacks. The attacks exist because it does not verify the validity of primary and subkey packets before signature verification, defeating the purpose of signature verification and compromising the traffic between legit users...
Debian DSA-4457-1 : evolution - security update
Hanno Bock discovered that Evolution was vulnerable to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted HTML email. This issue was mitigated by moving the security bar with encryption and signature information above the message headers. C Tenable Network Security,...
Debian: Security Advisory (DSA-4457-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DSA 4457-1] evolution security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4457-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 07, 2019 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4457-1] evolution security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4457-1 [email protected] https://www.debian.org/security/ Sebastien Delafond June 07, 2019 https://www.debian.org/security/faq -...
Security update for evolution (moderate)
openSUSE Security Update: Security update for evolution Announcement ID: openSUSE-SU-2019:1528-1 Rating: moderate References: 1125230 Cross-References: CVE-2018-15587 Affected Products: openSUSE Leap 42.3 An update that fixes one vulnerability is now available. Description: This update for...
SUSE SLED12 Security Update : evolution (SUSE-SU-2019:1391-1)
This update for evolution fixes the following issue : Security issue fixed : CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature bsc1125230. Note that Tenable Network Security has extracted the preceding description block directly from the...
SUSE-SU-2019:1391-1 Security update for evolution
This update for evolution fixes the following issue: Security issue fixed: - CVE-2018-15587: Fixed OpenPGP signatures spoofing via specially crafted email that contains a valid signature bsc1125230...