SUSE-SU-2017:1675-1 Security update for xorg-x11-server

This update for xorg-x11-server provides the following fixes: - Remove unused function with use-after-free issue. bsc1025035 - Use arc4random to generate cookies. bsc1025084 - Prevent timing attack against MIT cookie. bsc1025029, CVE-2017-2624 - XDrawArc performance improvement. bsc1019649 -...

SUSE-SU-2017:1632-1 Security update for tomcat6

This update for tomcat6 fixes the following issues: Tomcat was updated to version 6.0.53: The full changelog is: http://tomcat.apache.org/tomcat-6.0-doc/changelog.html Security issues fixed: - CVE-2017-5647: A bug in the handling of pipelined requests could lead to information disclosure bsc10366...

[SECURITY] [DLA 987-1] request-tracker4 security update

Package : request-tracker4 Version : 4.0.7-5+deb7u5 CVE ID : CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Multiple vulnerabilities have been discovered in Request Tracker, an extensible trouble-ticket tracking system. The Common Vulnerabilities and Exposures project identifies the...

Automattic: Timing attack woocommerce, simplify commerce gateway

file class-wc-gateway-simplify-commerce.php method returnhandler e.g. where woocommerce marks the order regarding its payment / transaction. public function returnhandler @obclean; header 'HTTP/1.1 200 OK' ; if isset $REQUEST'reference' && isset $REQUEST'paymentId' && isset $REQUEST'signature'...

openssl: ECDSA P-256 timing attack key recovery

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys...

openssl: ECDSA P-256 timing attack key recovery

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys...

openssl: ECDSA P-256 timing attack key recovery

A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys...

Timing Attack

jasypt is vulnerable to timing attacks. The attacks are possible because it uses Arrays.equals to verify passwords with different lengths, thereby revealing the time taken to compare the passwords...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

CVE-2014-9970

CVE-2014-9970 affects jasypt before 1.9.2, where a timing attack can be made against password hash comparisons. The provided documents confirm the existence of this timing vulnerability but do not specify a vendor patch or fixed version within the CVE entry. The impact is described as a confident...

CVE-2014-9970

jasypt before 1.9.2 allows a timing attack against the password hash comparison...

Timing Attack

Jetty Utils is vulnerable to timing attacks. The library is vulnerable because it does not compare passwords, message digests and credentials in constant-time. This allows malicious users to use the timing of the request to progressively identify a valid passwords, message digests and credentials...

CVE-2017-7488

A flaw was found where authconfig could configure sssd in a way that treats existing and non-existing logins differently, leaking information on existence of a user. An attacker with physical or network access to the machine could enumerate users via a timing attack. Mitigation Possible workaroun...

OpenJDK: DSA implementation timing attack (Libraries, 8168728)

A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...

Timing Attack

github.com/btcsuite/btcd is vulnerable to timing attacks. This vulnerability is caused because hashes are not compared in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...

Timing Attack

github.com/hashicorp/vault is vulnerable to timing attacks. This vulnerability is caused because passwords are not compared in constant time, allowing malicious users to guess valid passwords based on the time that a comparison takes...

Timing Attack

github.com/openshift/origin is vulnerable to timing attacks. This vulnerability is caused because the credentials are not compared in constant time, allowing malicious users to guess the valid credentials based on the time that a comparison takes...

Timing Attack

radicale is vulnerable to timing attacks. It does not compare passwords in constant time, because it uses a non-constant character to character comparison. Consequently, the comparison will fail faster when the first characters in the password are incorrect. Attackers can exploit this difference ...