1701 matches found
Insecure Signature Validation
thunderbird:sid has insecure signature validation. When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validit...
EulerOS Virtualization 3.0.2.0 : libgcrypt (EulerOS-SA-2021-2836)
According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a...
Security fix for the ALT Linux 10 package thunderbird version 91.4.1-alt1
91.4.1-alt1 built Dec. 27, 2021 Andrey Cherepanov in task 292439 Dec. 21, 2021 Andrey Cherepanov - New version. - Security fixes: + CVE-2021-4126 OpenPGP signature status doesn't consider additional message content + CVE-2021-44538 Matrix chat library libolm bundled with Thunderbird vulnerable to...
CVE-2021-4126
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...
MGASA-2021-0584 Updated thunderbird packages fix security vulnerability
OpenPGP signature status doesn't consider additional message content. CVE-2021-4126 Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. CVE-2021-44538...
Updated thunderbird packages fix security vulnerability
OpenPGP signature status doesn't consider additional message content. CVE-2021-4126 Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. CVE-2021-44538...
Security Vulnerabilities fixed in Thunderbird 91.4.1 — Mozilla
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...
PT-2021-7423
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.4.1 Description The issue is related to how Thunderbird handles OpenPGP/MIME signed email messages with additional outer MIME message layers. Previously, Thunderbird only considered the inner signed message for...
Mozilla Thunderbird < 91.4.1
The version of Thunderbird installed on the remote Windows host is prior to 91.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-55 advisory. - Thunderbird users who use the Matrix chat protocol were vulnerable to a buffer overflow in libolm, that an attack...
MGASA-2021-0563 Updated botan2 packages fix security vulnerability
Updated botan2 packages fix security vulnerability: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the...
Updated botan2 packages fix security vulnerability
Updated botan2 packages fix security vulnerability: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the...
EulerOS Virtualization 2.9.1 : libgcrypt (EulerOS-SA-2021-2759)
According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a...
EulerOS Virtualization 2.9.0 : libgcrypt (EulerOS-SA-2021-2795)
According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a...
Oracle Linux 8 : libgcrypt (ELSA-2021-4409)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4409 advisory. - Fix for CVE-2021-33560 1971421 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has no...
OESA-2021-1431 rpm security update
The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: The OpenPGP subkey is associated with the master key through a binding signature. RPM will not check their binding signature before importing the subkey; if the attacker can add it or the other...
libgcrypt: mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm
A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP. The highest threat from this vulnerability is to confidentiality...
MGASA-2021-0468 Updated libcryptopp packages fix security vulnerability
The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's...
Updated libcryptopp packages fix security vulnerability
The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's...
OESA-2021-1362 libgcrypt security update
Libgcrypt is a general purpose cryptographic library originally based on code from GnuPG. Security Fixes: The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime...
MGASA-2021-0446 Updated libgcrypt packages fix security vulnerability
The updated packages fix a security vulnerability: The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defin...