ALPINE-CVE-2019-1543

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value IV should be 96 bits 12 bytes. OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also...

PT-2019-1694

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1b OpenSSL versions 1.1.0 through 1.1.0j Description The issue is related to the ChaCha20-Poly1305 cipher in OpenSSL, which requires a unique nonce input for every encryption operation. According to RFC 7539,...

Scientific Linux Security Update : polkit on SL6.x i386/x86_64 (20190226)

Security Fixes : - polkit: Temporary auth hijacking via PID reuse and non-atomic fork CVE-2019-6133 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid122468; scriptversion"1.6";...

RHEL 6 : polkit (RHSA-2019:0420)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0420 advisory. The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privilege...

CentOS Update for polkit CESA-2019:0420 centos6

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Important: Red Hat Security Advisory: polkit security update

An update for polkit is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

polkit security update

0.96-11.el610.1 - Fix of CVE-2019-6133, PID reuse via slow fork - Resolves: rhbz1667310...

UBUNTU-CVE-2013-7469

Seafile through 6.2.11 always uses the same Initialization Vector IV with Cipher Block Chaining CBC Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks...

CVE-2013-7469

CVE-2013-7469 affects Seafile up to version 6.2.11, where the same Initialization Vector is reused in CBC mode to encrypt private data. This IV reuse enables chosen-plaintext or dictionary attacks against confidentiality. The primary sources note the vulnerability but do not provide a published p...

Houzz Urges Password Resets After Data Breach

Interior decorating website Houzz on Friday issued a notice that user data – including usernames, passwords and IP addresses – had been accessed by an “unauthorized third party.” Houzz connects consumers to varying home-goods departments or professionals for purchasing furniture. The Palo Alto,...

polkit security update

0.112-18.0.1 - Increase timeout to avoid defunct processes bug26930744 0.112-18.el76.1 - Fix of CVE-2019-6133, PID reuse via slow fork - Resolves: rhbz1667311...

Important: Red Hat Security Advisory: polkit security update

An update for polkit is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Stryker Medical Beds

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Public exploits are available Vendor: Stryker Equipment: Secure II MedSurg Bed, S3 MedSurg Bed, and InTouch ICU Bed Vulnerability: Reusing a Nonce 2. RISK EVALUATION Successful exploitation of this vulnerability could allow data traffic manipulation,...

Debian DLA-1644-1 : policykit-1 security update

Two vulnerabilities were found in Policykit, a framework for managing administrative policies and privileges : CVE-2018-19788 It was discovered that incorrect processing of very high UIDs in Policykit could result in authentication bypass. CVE-2019-6133 Jann Horn of Google found that Policykit...

CVE-2018-17679

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.2.0.9297. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Vulnerabilities fixed in Apache HTTP Server

Several vulnerabilities have been fixed in Apache HTTP Server. A remote malicious party could potentially exploit the vulnerabilities to cause a denial-of-service or to reuse an expired session cookie to be reused. Apache Software Foundation has made updates available for Apache HTTP Server to...

Omron CX-Supervisor Reuse After Release Vulnerability

Omron CX-Supervisor is a powerful and advanced machine visualization software package that provides a very flexible PC-based HMI environment. A post-release reuse vulnerability exists in Omron CX-Supervisor 3.42 and earlier versions, which stems from an application failing to check if a project...

PT-2019-1544 · Red Hat +2 · Red Hat Openshift Container Platform +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.158 and earlier Jenkins LTS versions 2.150.1 and earlier Jenkins affected versions not specified in Redhat OpenShift Container Platform Description: The issue is related to an improper authorization vulnerability that allow...

Information Disclosure

openstack-nova is vulnerable to information disclosure. When using libvirt and LVM backed instances, the contents of the physical volume PV are not properly wiped before the volume is returned to the system for use again, which could lead to the new instance being able to access confidential file...