3495 matches found
OpenJDK: DSA implementation timing attack (Libraries, 8168728)
A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...
OpenJDK: ECDSA implementation timing attack (Libraries, 8168724)
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE subcomponent: Libraries. Supported versions that are affected are Java SE: 7u121 and 8u112; Java SE Embedded: 8u111. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protoco...
OpenJDK: DSA implementation timing attack (Libraries, 8168728)
A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel...
CVE-2016-5224
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...
CVE-2016-5224
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...
Design/Logic Flaw
A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to bypass the Same Origin Policy via a crafted HTML page...
CVE-2016-5224
CVE-2016-5224 affects Chromium/Blink SVG handling. The Debian advisory and related feeds describe a same-origin policy bypass in the SVG component of the Chromium browser, with historical references to a timing-attack-derived bypass in denormalized floating-point SVG filters (Chrome prior to 55.0...
CVE-2016-5224
Removed by vendor...
Information Diclosure
bouncycastle is vulnerable to timing attacks. Due to the lack of blinding, a malicious user can monitor the time taken to generate a signature to gain information about the signatures k value and eventually the private value...
OpenSSL ECDSA P-256 Private Key Acquisition Vulnerability
OpenSSL is an open source capable of implementing the Secure Sockets Layer SSL v2/v3 and Secure Transport Layer TLS v1 protocols developed by the OpenSSL team as a general-purpose cryptographic library that supports a wide range of cryptographic algorithms including symmetric ciphers, hash...
FreeBSD : openssl -- timing attack vulnerability (7caebe30-d7f1-11e6-a9a5-b499baebfeaf)
Cesar Pereida Garcia reports : The signing function in crypto/ecdsa/ecdsaossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect...
Timing Attack
signature is vulnerable to timing attacks. The validatesignature function does not do constant-time comparisons when comparing signatures, allowing malicious users to find valid signatures based on the time that a comparison takes...
FreeBSD : tomcat -- multiple vulnerabilities (3ae106e2-d521-11e6-ae1b-002590263bf5)
The Apache Software Foundation reports : Low: Unrestricted Access to Global Resources CVE-2016-6797 Low: Security Manager Bypass CVE-2016-6796 Low: System Property Disclosure CVE-2016-6794 Low: Security Manager Bypass CVE-2016-5018 Low: Timing Attack CVE-2016-0762 %NASLMINLEVEL 70300 C Tenable...
openssl -- timing attack vulnerability
Cesar Pereida Garcia reports: The signing function in crypto/ecdsa/ecdsaossl.c in certain OpenSSL versions and forks is vulnerable to timing attacks when signing with the standardized elliptic curve P-256 despite featuring constant-time curve operations and modular inversion. A software defect...
Timing Attack
twilio-ruby is vulnerable to timing attacks. This vulnerability is caused because the signatures are not compared in constant time, allowing malicious users to guess the valid signatures are based on the time that a comparison takes...
Updated thunderbird packages fix security vulnerabilities
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption CVE-2016-9899. Event handlers on marquee elements were executed despite a strict Content Security Policy CSP that disallowed inline JavaScript CVE-2016-9895. Memory corruption...
Timing Attack
json-jwt is vulnerable to timing attacks. The library is vulnerable because they do not compare signatures in constant-time, which allows malicious users to use the timing of the request to progressively identify a valid signatures...
Mozilla Thunderbird < 45.6 Multiple Vulnerabilities (macOS)
The version of Mozilla Thunderbird installed on the remote macOS or Mac OS X host is prior to 45.6. It is, therefore, affected by the following vulnerabilities : - Multiple memory corruption issues exists, such as when handling document state changes or HTML5 content, or else due to dereferencing...
