Linux Distros Unpatched Vulnerability : CVE-2016-8614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ansible before version 2.2.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP ke...

Mozilla Thunderbird < 136.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 136.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-17 advisory. - Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. So...

Mozilla Thunderbird < 136.0

The version of Thunderbird installed on the remote Windows host is prior to 136.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-17 advisory. - Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of thes...

Mozilla Thunderbird < 128.8

The version of Thunderbird installed on the remote Windows host is prior to 128.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-18 advisory. - Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of thes...

Mozilla Thunderbird < 128.8

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-18 advisory. - Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. So...

CVE-2025-24888

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...

CVE-2025-24888

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...

CVE-2025-24888

The CVE-2025-24888 issue affects the SecureDrop Client, specifically the API.download_reply() path traversal flaw. The vulnerability arises from using the filename in the Content-Disposition header to write the encrypted reply to disk; although server-side filenames are sanitized, the file can be...

CVE-2025-24888 Path traversal in SecureDrop Client API.download_reply()

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...

[SECURITY] Fedora 40 Update: rust-sequoia-sqv-1.2.1-6.fc40

A simple OpenPGP signature verification program...

PT-2025-10625 · Mozilla +4 · Thunderbird +4

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 136 Thunderbird versions prior to 128.8 Description: The issue arises when requesting an OpenPGP key from a WKD server, where an incorrect padding size was used. This could allow a network observer to learn the...

PT-2025-10626 · Mozilla +5 · Thunderbird +5

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 136 Thunderbird versions prior to 128.8 Description: The issue arises from certain crafted MIME email messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message,...

Astra Linux – Vulnerability in opensc

A heap-based buffer overflow vulnerability was discovered in the libopensc OpenPGP driver. A specially crafted USB device or smart card, containing malicious responses to APDUs during the card enrollment process using the pkcs15-init tool, may lead to unauthorized access, potentially resulting in...

GNU Transport Layer Security Library 3.8.9

GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...

[SECURITY] Fedora 41 Update: rust-sequoia-sqv-1.2.1-6.fc41

A simple OpenPGP signature verification program...

[SECURITY] Fedora 41 Update: rust-sequoia-sop-0.36.0-3.fc41

An implementation of the Stateless OpenPGP Interface using Sequoia...

CVE-2024-53856

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1...

CVE-2024-53857

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys...

Security update for opensc

This update for opensc fixes the following issues: CVE-2024-8443: Fixed heap buffer overflow in OpenPGP driver when generating key bsc1230364 CVE-2024-45620: Fixed incorrect handling of the length of buffers or files in pkcs15init bsc1230076 CVE-2024-45619: Fixed incorrect handling length of...

Cleartext Storage of Sensitive Information

Overview net.sourceforge.pmd:pmd-designer is a graphical tool that helps PMD users develop their custom rules Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the form of the passphrase for gpg.keyname=0xD0BF1D737C9A1C22 appearing in the Maven jar ...