Ubuntu: Security Advisory (USN-2880-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2880-1: Firefox vulnerabilities

Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, Randell Jesup, Nicolas Pierron, Eric Rescorla, Tyson Smith, and Gabor Krizsanits discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker...

Mozilla Firefox 44 Security Patches

Mozilla has patched a number of critical vulnerabilities in Firefox 44 and Firefox Extended Release 38.6, which were released this week. The most serious flaws were memory vulnerabilities that lived in both the public and extended support versions of the browser. A buffer overflow write in WebGL,...

Errors in mp_div and mp_exptmod cryptographic functions in NSS — Mozilla

Security researcher Hanno Böck reported that calculations with mpdiv and mpexptmod in Network Security Services NSS can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially crafted application...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the MediaTek misc-sd driver for the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created application...

The vulnerability of the application interface of the IBM WebSphere Portal server allows a hacker to circumvent existing access restrictions.

The vulnerability of the IBM WebSphere Portal application server’s user interface is related to deficiencies in access control for certain functions. Exploiting this vulnerability could allow a malicious actor to bypass existing access restrictions by using a specially crafted request...

Fewer IPsec VPN Connections at Risk to Weak Diffie-Hellman

A challenge has been made against one of the conclusions in a potentially blockbuster academic paper on cryptographic weaknesses that may be the open door through which intelligence agencies are breaking encrypted connections. The paper, “Imperfect Forward Secrecy: How Diffie-Hellman Fails in...

NSA Exploiting Weak Diffie-Hellman Primes to Break Crypto

The great mystery since the NSA and other intelligence agencies’ cyber-spying capabilities became watercooler fodder has not been the why of their actions, but the how? For example, how are they breaking crypto to decode secure Internet communication? A team of cryptographers and computer...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a local attacker to enhance their privileges through a specially crafted application...

The vulnerability of the Internet Explorer browser, which allows a hacker to elevate their privileges

The vulnerability of the Internet Explorer browser is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially crafted web page...

Google Outlines Plans to Deprecate RC4, SSLv3

As expected, Google formally announced its intent to move away from the stream cipher RC4 and the SSLv3 protocol this week, citing a long history of weaknesses in both. Adam Langley, a security engineer for the company, announced the plans through a blog post on Thursday. While there isn’t a...

Google, Mozilla End RC4 Support

Google, Microsoft and Mozilla today announced they’ve settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. Attacks against RC4 are growing increasingly practical, rendering the algorithm more untrustworthy by the day. The browser makers plan to sever support for RC4...

Vulnerabilities of iOS and Mac OS X operating systems, which allow attackers to bypass the code signing protection mechanism

The vulnerability of iOS and Mac OS X operating systems is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass the code signing mechanism by adding code to the created executable file...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x, SL7.x i386/x86_64 (20150730) (Bar Mitzvah) (Logjam)

Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-4733 A flaw was fou...

The vulnerability of Adobe Acrobat’s PDF editing software allows a hacker to circumvent existing access restrictions.

The vulnerability of Adobe Acrobat’s PDF editing software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions from a remote location...

USN-2696-1: OpenJDK 7 vulnerabilities

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service or expose sensitive data over the network. CVE-2015-2590, CVE-2015-2628, CVE-2015-4731, CVE-2015-4732,...

The vulnerability of the Cisco IOS operating system, which allows a hacker to increase their privileges

The vulnerability of the TCL interpreter component in the Cisco IOS operating system is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker, operating locally, to enhance their privileges by executing the TCL script...

Apache security vulnerabilities

DoS, few potential vulnerabilities...

TLS Version 1.0 Protocol Detection (PCI DSS)

The remote service accepts connections encrypted using TLS 1.0. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients. C Tenable Network...