SUSE-SU-2020:3091-1 Security update for MozillaThunderbird and mozilla-nspr

This update for MozillaThunderbird and mozilla-nspr fixes the following issues: - Mozilla Thunderbird 78.4 new: MailExtensions: browser.tabs.sendMessage API added new: MailExtensions: messageDisplayScripts API added changed: Yahoo and AOL mail users using password authentication will be migrated ...

Debian DLA-2408-1 : thunderbird security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. Debian follows the Thunderbird upstream releases. Support for the 68.x series has ended, so starting with this update we're now following the 78.x releases. The 78.x...

Debian: Security Advisory (DLA-2408-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2408-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2408-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 17, 2020 https://wiki.debian.org/LTS -...

Debian DSA-4770-1 : thunderbird - security update

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. Debian follows the Thunderbird upstream releases. Support for the 68.x series has ended, so starting with this update we're now following the 78.x releases. The 78.x...

[SECURITY] [DSA 4770-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4770-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 06, 2020 https://www.debian.org/security/faq -...

[SECURITY] Fedora 33 Update: gnupg2-2.2.23-1.fc33

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 33 Update: gnutls-3.6.15-1.fc33

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

[SECURITY] Fedora 31 Update: gnutls-3.6.15-1.fc31

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

[ASA-202009-5] gnupg: arbitrary code execution

Arch Linux Security Advisory ASA-202009-5 ========================================= Severity: Critical Date : 2020-09-07 CVE-ID : CVE-2020-25125 Package : gnupg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1218 Summary ======= The package gnupg before...

ALPINE-CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

Buffer overflow

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

CVE-2020-25125

CVE-2020-25125 affects GnuPG 2.2.21/2.2.22 (and Gpg4win 3.1.12). An array overflow in g10/key-check.c can cause a crash or unspecified impact when importing an attacker’s OpenPGP key with AEAD preferences; GnuPG 2.2.23 fixes this (2.3.x is unaffected). Remediation: upgrade to a fixed version (2.2...

CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

CVE-2020-25125

GnuPG 2.2.21 and 2.2.22 and Gpg4win 3.1.12 has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG...

gnupg -- AEAD key import overflow

Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes ...

DEBIAN-CVE-2020-24972

The Kleopatra component before 3.1.12 and before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL...

Amazon Linux 2 : evolution (ALAS-2020-1476)

The version of evolution installed on the remote host is prior to 3.28.5-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1476 advisory. GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted ema...

Medium: evolution

Issue Overview: GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. CVE-2018-15587 Affected Packages: evolution Note: This advisory i...