Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid...

CVE-2021-30493

Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other...

Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid...

Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid...

Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

CVE-2021-23993

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid...

UBUNTU-CVE-2021-23991

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

CVE-2021-23991

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might...

November 19, 2020—KB4594441 (OS Build 14393.4048) Out-of-band

None None...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in the Ansible Engine. When using ansiblefacts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansiblefacts after the clean, an attacker could take advantage of this by altering the ansiblefacts leading to privilege escalation or...

UBUNTU-CVE-2020-10684

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansiblefacts after the clean. An attacker could take advantag...

PT-2020-5206

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.7.17 Ansible Engine versions 2.8.x through 2.8.9 Ansible Engine versions 2.9.x through 2.9.6 Description A flaw was found in Ansible Engine when using ansible facts as a subkey of itself and promoting it...

CVE-2018-9234

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey...

Man-in-the-Middle (MitM)

openpgp is vulnerable to man-in-the-middle MitM attacks. The attacks exist because it does not verify the validity of primary and subkey packets before signature verification, defeating the purpose of signature verification and compromising the traffic between legit users...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : GnuPG vulnerabilities (USN-3675-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3675-1 advisory. Marcus Brinkmann discovered that during decryption or verification, GnuPG did not properly filter out terminal sequences when...