Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fixes: Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6856 Mozilla: Memory safety bugs fixed in Firefox 121, Firefo...

NewStart CGSL MAIN 6.06 : libgcrypt Vulnerability (NS-SA-2023-0085)

The remote NewStart CGSL host, running version MAIN 6.06, has libgcrypt packages installed that are affected by a vulnerability: - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous...

PT-2023-7922 · Mozilla +9 · Thunderbird +9

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 115.6 Description: The issue is related to errors in handling OpenPGP cryptographic signatures. Exploitation of this issue may allow a remote attacker to perform a spoofing attack. When processing a PGP/MIME...

[SECURITY] Fedora 38 Update: rust-sequoia-wot-0.5.0-4.fc38

An implementation of OpenPGP's web of trust...

[SECURITY] Fedora 39 Update: rust-sequoia-wot-0.5.0-4.fc39

An implementation of OpenPGP's web of trust...

Fedora: Security Advisory for rust-sequoia-wot (FEDORA-2023-9790b327cb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for rust-sequoia-wot (FEDORA-2023-6215ea423b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 39 Update: gnutls-3.8.2-1.fc39

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

opensc security update

0.23.0-2 - Fix regression in handling OpenPGP cards - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos 0.23.0-1 - Rebase to latest 0.23.0 release 2100409 - Use separate OpenSSL context to work better from inside of OpenSSL providers...

Rocky Linux 8 : rpm (RLSA-2022:0368)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0368 advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check the binding...

Oracle Linux 8 : evolution (ELSA-2020-1600)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1600 advisory. - Update patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar - Add patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar Tenable has...

Oracle Linux 7 : evolution (ELSA-2020-1080)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1080 advisory. - Update patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar - Add patch for RH bug 1686408 CVE-2018-15587: Reposition signature bar - Ad...

PGP Signature Spoofing

openpgp is vulnerable to PGP Signature Spoofing. The vulnerability exists due to ignoring text before the hash: ... section. An attacker can append text to the start of of the line, which will appear as signed but the library ignores verifying it...

@aloe2/abstract-eth (1.0.20228282226), @aloe2/abstract-utxo (1.1.20228282226) +172 more potentially affected by CVE-2023-41037 via openpgp (>=5.0.0, <=5.9.0)

openpgp NPM version =5.0.0, =5.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on openpgp and may be impacted: - @aloe2/abstract-eth 1.0.20228282226 - @aloe2/abstract-utxo 1.1.20228282226 - @aloe2/account-lib 2.20.20228282226 - @aloe2/bitgo...

@blinkhealth/config-yourself (>=1.0.0, <=1.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +18 more potentially affected by CVE-2023-41037 via openpgp (>=4.5.1, <=4.10.10)

openpgp NPM version =4.5.1, =1.0.0, =1.30.3, =9.0.0-dev.5644f38, =0.0.1, =1.1.6, =0.0.1, =2.0.0, =0.3.4, =0.9.0, =1.25.0, =1.31.0 and more Source cves: CVE-2023-41037 Source advisory: OSV:GHSA-CH3C-V47X-4PGP...

GHSA-CH3C-V47X-4PGP Cleartext Signed Message Signature Spoofing in openpgp

Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...

Cleartext Signed Message Signature Spoofing in openpgp

Impact OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This text is signed. -----BEGIN PGP SIGNATURE----- wnUEARMIACcFgmTkrNAJkInXCgj0fgcIFiEE1JlKzzDGQxZmmHkYidcKCPR+...

Design/Logic Flaw

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

CVE-2023-41037 Cleartext Signed Message Signature Spoofing in openpgpjs

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

CVE-2023-41037

OpenPGP.js vulnerability (CVE-2023-41037) in Cleartext Signed Messages: versions up to 5.9.0 ignore data before the Hash: header, enabling text insertion that appears signed. Impact arises if an app verifies only verificationResult.verified and visually trusts the message; otherwise, verified dat...