kernel: NULL pointer dereference in keyring_search_aux function

The keyringsearchaux function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service via a requestkey system call for the "dead" key type...

CVE-2017-6951

The keyringsearchaux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service NULL pointer dereference and OOPS via a requestkey system call for the "dead" type...

Google Adds Security Key Enforcement to G Suite Apps

Google on Wednesday pumped more life into the use of physical keys as a second form of authentication when it added Security Key enforcement support to G Suite. Admins inside enterprises managing deployments of the suite of cloud-based productivity apps, formerly known as Google Apps, can now...

Facebook Adds FIDO U2F Security Keys Feature For Secure Logins

Hacking password for a Facebook account is not easy, but also not impossible. We have always been advising you to enable two-factor authentication — or 2FA — to secure your online accounts, a process that requires users to manually enter, typically a six-digit secret code generated by an...

Linux kernel denial of service vulnerability (CNVD-2016-11669)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the security/keys/bigkey.c file in Linux kernel versions prior to 4.8.7. A local attacker can exploit this vulnerability to cause a...

Generate Security Keys warning on Storefront management console

Question:Is the warning to generate new security keys related to the Server certificate used for storefront base URL? Answer: No, this warning is not related to the server certificate used for storefront base URL. This indicates that the Self-Signed certificates generated by storefront are expire...

kernel security and bug fix update

3.10.0-327.28.2.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.28.2 - net bridge: include in6.h in ifbridge.h for struct in6addr Jiri Benc 1331285 1268057 - net inet: defines IPPROTO needed for module alias generation Jiri Benc 1331285 1268057 - net sync some IP headers with glibc Jir...

Vulnerabilities in operating systems such as Mac OS X and iOS, which allow attackers to gain access to security keys

The vulnerability of operating systems Mac OS X and iOS is related to improper handling of access control lists for security keys. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to security keys through a specially created application...

CVE-2015-8539

The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service BUG via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/userdefined.c...

CVE-2016-0728

The joinsessionkeyring function in security/keys/processkeys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service integer overflow and use-after-free via crafted keyctl commands...

Command injection

The keygcunusedkeys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service OOPS via crafted keyctl commands...

CVE-2014-7878

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

Code injection

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

CVE-2014-7878

The Application Lifecycle Service ALS in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived from the Seed Node image, uses the same security keys across different customers' installations, which allows remote attackers to execute arbitrary code by leveraging these keys fo...

CVE-2014-7878

The CVE-2014-7878 issue affects HP Helion Cloud Development Platform 1.0: the Application Lifecycle Service (ALS) Seed Node image contains identical security keys across different customer installations, enabling a remote attacker with a VM derived from the Seed Node image to connect to other VMs...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2037)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2037 advisory. - netdrv be2net: Merge fixes for CVE-2011-3347 Joe Jin Tenable has extracted the preceding description block directly from the Oracle Linux securit...

Cracking iPhone Hotspot password in 50 Seconds

The ability to turn your iPhone into a Wi-Fi hotspot is a fantastically useful little tool in and of itself. When setting up a personal hotspot on their iPad or iPhone, users have the option of allowing iOS to automatically generate a password. According to a new study by Researchers at the...

DEBIAN-CVE-2013-1792

Race condition in the installuserkeyrings function in security/keys/processkeys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service NULL pointer dereference and system crash via crafted keyctl system calls that trigger keyring operations in simultaneous threads...

kernel: keys: NULL pointer deref in the user-defined key type

The userupdate function in security/keys/userdefined.c in the Linux kernel 2.6 allows local users to cause a denial of service NULL pointer dereference and kernel oops via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."...

kernel: keys: NULL pointer deref in the user-defined key type

The userupdate function in security/keys/userdefined.c in the Linux kernel 2.6 allows local users to cause a denial of service NULL pointer dereference and kernel oops via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."...