openSUSE Security Update : libxslt (openSUSE-2017-609)

This update for libxslt fixes the following security issues : - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. ...

SUSE SLED12 / SLES12 Security Update : libxslt (SUSE-SU-2017:1313-1)

This update for libxslt fixes the following issues : - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. -...

SUSE-SU-2017:1313-1 Security update for libxslt

This update for libxslt fixes the following issues: - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. -...

SUSE SLES11 Security Update : libxslt (SUSE-SU-2017:1282-1)

This update for libxslt fixes the following issues : - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. -...

SUSE-SU-2017:1282-1 Security update for libxslt

This update for libxslt fixes the following issues: - CVE-2017-5029: The xsltAddTextString function in transform.c lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page bsc1035905. -...

UBUNTU-CVE-2017-5462

A flaw in DRBG number generation within the Network Security Services NSS library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerabili...

Entropy Insufficiency Vulnerability in Pseudo-Random Number Generation in SIEMENS Desigo PX Web Module

SIEMENS Building Automation Systems Desigo PX programmable automation station offers a flexible solution with the ability to signal alarms, time-based logging programs and trends that can be modified or expanded at any time. An entropy insufficiency vulnerability exists in the pseudo-random numbe...

libgcrypt: PRNG output is predictable

A design flaw was found in the libgcrypt PRNG Pseudo-Random Number Generator. An attacker able to obtain the first 580 bytes of the PRNG output could predict the following 20 bytes...

Vulnerability of the 1C-Bitrix web project management system: The website management feature allows a remote attacker to obtain a reset password for any user, as well as the user’s own password.

Vulnerability of the 1C-Bitrix web project management system: Website management related to errors in the code of the pseudo-random number generator mtrand. Exploiting this vulnerability allows an unauthorized attacker to obtain confirmation codes for resetting passwords of any user, as well as t...

expat: multiple issues

CVE-2012-6702 predictable random numbers It was found that when calling XMLParse ahead of rand, it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 denial of service It was found that original fix for CVE-2012-0876 used too little entropy for the hash...

lib32-expat: multiple issues

CVE-2012-6702 predictable random numbers It was found that when calling XMLParse ahead of rand, it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 denial of service It was found that original fix for CVE-2012-0876 used too little entropy for the hash...

Gentoo Security Advisory GLSA 201408-14

Gentoo Linux Local Security Checks GLSA 201408-14 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

AnchorCMS PHP Object Injection and Weak PNRG Generation Vulnerabilities

AnchorCMS is an open source lightweight blogging system. AnchorCMS remote PHP object injection and weak PNRG generator vulnerability allows attackers to submit specially crafted serialized objects or brute-force attack to inject arbitrary objects and execute arbitrary PHP code...

Orient Technologies Studio for OrientDB Server Community Edition Random Number Generation Vulnerability

Orient Technologies Studio for OrientDB Server Community Edition is a community edition of OrientDB Server from Orient Technologies, UK. A problem with Orient Technologies Studio for OrientDB Server Community Edition random number generation allows remote attackers to exploit vulnerabilities to...

Concrete CMS: Weak random number generator used in concrete/authentication/concrete/controller.php

php private function genString$a = 20 $o = ''; $chars = 'abcdefghijklmnopqrstuvwxyz0123456789!@$%^&+|":?'\'; $l = strlen$chars; while $a-- $o .= substr$chars, rand0, $l, 1; return md5$o; Using substrrand then running md5 on the output would be better replaced by using bin2hex and either...

GLSA-201408-14 : stunnel: Information disclosure

The remote host is affected by the vulnerability described in GLSA-201408-14 stunnel: Information disclosure stunnel does not properly update the state of the pseudo-random generator after fork-threading which causes subsequent children with the same process ID to use the same entropy pool. ECDSA...

stunnel: Information disclosure

Background The stunnel program is designed to work as an SSL encryption wrapper between a client and a local or remote server. Description stunnel does not properly update the state of the pseudo-random generator after fork-threading which causes subsequent children with the same process ID to us...

openSUSE Security Update : libssh (openSUSE-SU-2014:0366-1)

libssh was updated to fix a random generator reseeding issue when forking multiple servers. Forking multiple servers might under some circumstances get them the same random seed state. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

DEBIAN-CVE-2014-0017

The RANDbytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator PRNG, which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid...

PYSEC-2013-29

The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator PRNG before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a...