Linux kernel security vulnerabilities

ptrace information leakage, debug functions privilege escalation, cprng weak PRNG, networking dissector DoS, multiple integer overflows, buffer overlows in WiMax, USB and different devices drivers, UDP fragmentation offload uninitialized memory, privilege escalations. NAT conntrack information...

Multiple Vulnerabilities in Firefox for Android Leak Sensitive Information

The Android operating system has hardened its security with application Sandboxing features to ensure that no application can access sensitive information held by another without proper privileges. Android applications communicate with each other through Intents and these intents can be abused by...

stunnel < 5.00 PRNG State Security Weakness

The version of stunnel installed on the remote host is prior to version 5.00. It is, therefore, affected by a security weakness due to the PRNG state not being reset for new connections where the server forks. A remote attacker can exploit this issue to disclose sensitive information, such as the...

CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator PRNG, which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC ECDSA or DSA...

Code injection

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator PRNG, which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC ECDSA or DSA...

CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator PRNG, which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC ECDSA or DSA...

CVE-2014-0016

CVE-2014-0016 affects stunnel prior to 5.00 where PRNG state is not properly updated after fork-threading. This can cause subsequent child processes (sharing the same PID) to reuse the same entropy pool, enabling attackers to potentially obtain private keys for EC (ECDSA) or DSA certificates when...

CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator PRNG, which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC ECDSA or DSA...

CVE-2014-0016

stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator PRNG, which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC ECDSA or DSA...

Apple iOS PRNG熵漏洞

Apple iOS是一款运行在苹果iPhone和iPod touch设备上的最新的操作系统。 Apple iOS用于物理内核映射随机化，stack-check guard，zone cookie保护等的Early Random PRNG存在一个缺陷，由于使用弱熵，允许攻击者利用漏洞恢复输出，绕过利用保护机制进行攻击。 0 Apple iOS 7.0 目前没有详细解决方案提供： http://www.apple.com/support/downloads/...

Ubuntu: Security Advisory (USN-2145-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-0017

The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG, which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid...

Cross site request forgery (csrf)

The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG, which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid...

CVE-2014-0017

CVE-2014-0017 affects libssh prior to 0.6.3 where RAND_bytes state is not re-seeded after fork, causing PRNG state to be shared between child processes. This can lead to leakage of private keys for servers using ECC (ECDSA) or DSA certificates under certain conditions. The issue is resolved by up...

CVE-2014-0017

The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG, which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid...

CVE-2014-0017

The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG, which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid...

Debian DSA-2879-1 : libssh - security update

It was discovered that libssh, a tiny C SSH library, did not reset the state of the PRNG after accepting a connection. A server mode application that forks itself to handle incoming connections could see its children sharing the same PRNG state, resulting in a cryptographic weakness and possibly...

Mandriva Linux Security Advisory : libssh (MDVSA-2014:053)

Updated libssh package fixes security vulnerability : When using libssh before 0.6.3, a libssh-based server, when accepting a new connection, forks and the child process handles the request. The RANDbytes function of openssl doesn't reset its state after the fork, but simply adds the current...

[SECURITY] [DSA 2879-1] libssh security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2879-1 [email protected] http://www.debian.org/security/ Raphael Geissert March 13, 2014 http://www.debian.org/security/faq -...

[USN-2145-1] libssh vulnerability

========================================================================== Ubuntu Security Notice USN-2145-1 March 12, 2014 libssh vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...