Code injection

RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS 1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key...

CVE-2018-11070

Affected software: RSA BSAFE Crypto-J and RSA BSAFE SSL-J. Vulnerable components are the PKCS #1 unpadding path that enables a covert timing channel (Bleichenbacher-style) attack. Versions prior to 6.2.4 for both Crypto-J and SSL-J are impacted. Impact: a remote attacker could potentially recover...

CVE-2018-11070

RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS 1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key...

[SECURITY] Fedora 28 Update: python-pycryptodomex-3.6.6-1.fc28

PyCryptodome is a self-contained Python package of low-level cryptographic primitives. It's a fork of PyCrypto. It brings several enhancements with respect to the last official version of PyCrypto 2.6.1, for instance: Authenticated encryption modes GCM, CCM, EAX, SIV, OCB Accelerated AES on Intel...

CVE-2018-9192

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx bein...

CVE-2018-9194

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used...

CVE-2018-9194

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used...

CVE-2018-9194

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used...

CVE-2018-9192

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx bein...

CVE-2018-9194

CVE-2018-9194 relates to a plaintext recovery/MiTM vulnerability in RSA PKCS#1 v1.5 encryption exposed under Fortinet FortiOS VIP SSL when CPx is used, affecting FortiOS 5.4.6–5.4.9 and 6.0.0–6.0.1. The issue arises without knowledge of the server’s private key. Connected sources identify the vul...

CVE-2018-9194

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used...

CVE-2018-9192

The CVE-2018-9192 entry corresponds to the ROBOT attack against RSA PKCS#1 v1.5 in Fortinet FortiOS when SSL Deep Inspection CPx is used. Connected documents confirm a Bleichenbacher-style plaintext-recovery/MiTM vulnerability affecting FortiOS versions 5.4.6–5.4.9 and 6.0.0–6.0.1. The root cause...

Heap overflow

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6.1 in 4.1.x, contains an Improper Clearing of Heap Memory Before Release 'Heap Inspection' vulnerability. Decoded PKCS 12 data in heap memory is not zeroized by MES before releasing the memory internally and a...

CVE-2018-11055

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6.1 in 4.1.x, contains an Improper Clearing of Heap Memory Before Release 'Heap Inspection' vulnerability. Decoded PKCS 12 data in heap memory is not zeroized by MES before releasing the memory internally and a...

CVE-2018-11055

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6.1 in 4.1.x, contains an Improper Clearing of Heap Memory Before Release 'Heap Inspection' vulnerability. Decoded PKCS 12 data in heap memory is not zeroized by MES before releasing the memory internally and a...

The ROBOT Attack - Return of Bleichenbacher's Oracle Threat

A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key...

Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities

Binary data 700332.prm...

Mozilla Firefox < 57 Multiple Vulnerabilities

Binary data 700322.prm...

Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM® SDK for Node.js™ in IBM Bluemix

Summary OpenSSL vulnerabilities were disclosed on June 11, 2015 by the OpenSSL Project. This includes the Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol CVE-2015-4000 which affects IBM SDK for Node.js in IBM Bluemix. Vulnerability Details CVEID: CVE-2015-4000...

[SECURITY] Fedora 28 Update: botan2-2.7.0-1.fc28

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...