openSUSE 10 Security Update : gnutls (gnutls-2118)

A security problem was fixed in the GNU TLS library, where excess data was not checked during signature checking with RSA keys with exponent 3. This problem could be used to fake those RSA signatures. CVE-2006-4790 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-2252)

This security update brings Mozilla Thunderbird to version 1.5.0.8. More Details can be found on this page: http://www.mozilla.org/projects/security/known-vulnerabilities.html It includes fixes to the following security problems : MFSA2006-65: Is split into 3 sub-entries, for ongoing stability...

openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-2100)

This security update brings Mozilla Thunderbird to version 1.5.0.7. More Details can be found on this page: http://www.mozilla.org/projects/security/known-vulnerabilities.html It includes fixes to the following security problems: MFSA 2006-64/CVE-2006-4571: Crashes with evidence of memory...

openSUSE 10 Security Update : seamonkey (seamonkey-2098)

This security update brings Mozilla SeaMonkey to version 1.0.5. Please also see http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details. It includes fixes to the following security problems: MFSA 2006-64/CVE-2006-4571: Crashes with evidence of memory corruption MFSA...

openSUSE 10 Security Update : bind (bind-2269)

The RSA signature problem tracked by the Mitre CVE ID CVE-2006-4339 also affects the DNSSEC implementation in the BIND nameserver. This update fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSU...

openSUSE 10 Security Update : seamonkey (seamonkey-2250)

This security update brings Mozilla SeaMonkey to version 1.0.6. Please also see http://www.mozilla.org/projects/security/known-vulnerabilities.html for more details. It includes fixes to the following security problems: MFSA2006-65: Is split into 3 sub-entries, for ongoing stability improvements ...

openSUSE 10 Security Update : openssl (openssl-2069)

This update fixes a bug in OpenSSL that allowed the forgery of some special RSA signatures. CVE-2006-4339 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openssl-2069. The text description of...

Important: Red Hat Security Advisory: openssl security update

Updated OpenSSL packages that correct several security issues are now available for Red Hat Enterprise 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer...

openssl: RSA side-channel attack

The BNfrommontgomery function in crypto/bn/bnmont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, which might allow local users to conduct a side-channel attack and retrieve RSA private keys...

Mandrake Linux Security Advisory : openssl (MDKSA-2007:193)

A flaw in how OpenSSL performed Montgomery multiplications was discovered %that could allow a local attacker to reconstruct RSA private keys by examining another user's OpenSSL processes CVE-2007-3108. Moritz Jodeit found that OpenSSL's SSLgetsharedciphers function did not correctly check the siz...

GLSA-200710-06 : OpenSSL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200710-06 OpenSSL: Multiple vulnerabilities Moritz Jodeit reported an off-by-one error in the SSLgetsharedciphers function, resulting from an incomplete fix of CVE-2006-3738. A flaw has also been reported in the BNfrommontgomery...

OpenSSL: Multiple vulnerabilities

Background OpenSSL is an implementation of the Secure Socket Layer and Transport Layer Security protocols. Description Moritz Jodeit reported an off-by-one error in the SSLgetsharedciphers function, resulting from an incomplete fix of CVE-2006-3738. A flaw has also been reported in the...

USN-522-1: openssl vulnerabilities

It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Local attackers might be able to reconstruct RSA private keys by examining another user's OpenSSL processes. CVE-2007-3108 Moritz Jodeit discovered that OpenSSL's SSLgetsharedciphers function did not correctly...

CVE-2007-4900

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

Cross site scripting

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-4900

Cross-site scripting XSS vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web script or HTML via the username field...

CVE-2007-4900

CVE-2007-4900 describes a cross-site scripting (XSS) flaw in the logon page of RSA EnVision 3.3.6 Build 0115. The issue allows an attacker to inject arbitrary script/HTML via the username field, potentially enabling user-side script execution in a victim’s browser. The connected records confirm t...

RSA EnVision Reflected XSS Hole

Application: RSA EnVision Vendor: http://www.rsa.com Version: Version 3.3.6 Build 0115 Bug: Cross-Site Scripting Risk: Medium Date: 12 Sept 2007 Author: Stelios Tigkas e-mail: Stigkas at Gmail dot com Current Employer: Fujitsu Services List: BugTraqSecurityFocus ======= Product ======= A Security...

RSA Envision crossite scripting

Crossite scripting with username...

OpenSSL cryptographic vulnerability

Montgomery multiplication for elleptic cryptography is not applied in BNfrommontgomery functions, making it possible to retrieve RSA private key of different user...