SUSE-SU-2020:1685-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: java-180-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 bsc1172277,bsc1169511,bsc1160968 - CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service - CVE-2020-2754:...

openSUSE Security Update : strongswan (openSUSE-2020-403)

This update for strongswan fixes the following issues : Strongswan was updated to version 5.8.2 jscSLE-11370. Security issue fixed : - CVE-2018-6459: Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation bsc1079548. Full changelog...

Security update for strongswan (moderate)

openSUSE Security Update: Security update for strongswan Announcement ID: openSUSE-SU-2020:0403-1 Rating: moderate References: 1079548 Cross-References: CVE-2018-6459 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for...

SUSE SLED15 / SLES15 Security Update : strongswan (SUSE-SU-2020:0743-1)

This update for strongswan fixes the following issues : Strongswan was updated to version 5.8.2 jscSLE-11370. Security issue fixed : CVE-2018-6459: Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation bsc1079548. Full changelogs ...

New Crypto in Go 1.14

Go 1.14 is out and with it come a few nice updates to crypto/tls! Will this certificate work? Certificate selection in TLS1 is a mess. I was going to try and describe it here to make the point, but I kept getting it wrong and it was even too messy for something just meant to make the point that i...

Ubuntu: Security Advisory (USN-4267-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 16.04 LTS : ARM mbed TLS vulnerabilities (USN-4267-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4267-1 advisory. It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by an attacked to execute arbitrary code or cause a...

USN-4267-1: ARM mbed TLS vulnerabilities

It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by an attacked to execute arbitrary code or cause a denial of service. CVE-2017-18187 It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause a...

Security Bulletin: Vulnerabilities in OpenSSL affects Rational Application Developer for WebSphere Software

Summary OpenSSL vulnerabilities were disclosed on March 19, 2015 by the OpenSSL Project. OpenSSL is used by the Cordova platform packaged with Rational Application Developer for WebSphere Software and has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-0207 DESCRIPTION: OpenS...

CVE-2014-3809

Cross-site scripting XSS vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch PSS 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html...

Cross site scripting

Cross-site scripting XSS vulnerability in the management interface in Alcatel-Lucent 1830 Photonic Service Switch PSS 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html...

CVE-2014-3809

CVE-2014-3809 describes a reflected cross-site scripting (XSS) vulnerability in the management interface of Alcatel-Lucent 1830 Photonic Service Switch (PSS) 6.0 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the myurl parameter to menu/pop.html. The root...

Drake Lyrics Used as Calling Card in Malware Attack

A hacker with the handle “Master X” leverages a PowerShell script that contains a reference to singer-songwriter Drake lyric’s “Kiki Do You Love Me” and ultimately delivers a malicious payload to its victims. The campaign is email based; with missives containing a malicious PowerPoint attachment...

Denial Of Service (DoS)

OpenSSL is vulnerable to denial of service DoS attacks. A malicious user can pass a malicious ASN.1 encoded RSA PSS certificate to the system that can cause a null pointer dereference that can lead to the system crashing...

Fedora 29 : opensc (2018-fe4b72fa7d)

Security fix for CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, CVE-2018-16427 + support for RSA-PSS signatures. Note that Tenable Network Security has extracted the preceding description block directly from the Fedo...

Fedora 28 : opensc (2018-d0dff2abaa)

Security fix for CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, CVE-2018-16427 + support for RSA-PSS signatures. Note that Tenable Network Security has extracted the preceding description block directly from the Fedo...

pss-steering.com XSS vulnerability

Open Bug Bounty ID: OBB-704367 Description| Value ---|--- Affected Website:| pss-steering.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden...

Evidence for the Security of PKCS #1 Digital Signatures

This is interesting research: "On the Security of the PKCS1 v1.5 Signature Scheme": Abstract: The RSA PKCS1 v1.5 signature algorithm is the most widely used digital signature scheme in practice. Its two main strengths are its extreme simplicity, which makes it very easy to implement, and that...

Security Bulletin: Apache Struts Vulnerability CVE-2017-9791 will not affect PSS products

Summary The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. Among all the PSS products LSF, PPM, RTM, PWS, only PWS 9.1 and 9.1.3 have Struts libs in the package. However, PWS will not use the libs...

CVE-2015-9258

In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might for example be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed2551...