CVSS: 5.9EPSS: 96%CPEs: 60EXPL: 2CVE-2016-2107 – OpenSSL - Padding Oracle in AES-NI CBC MAC Check
https://notcve.org/view.php?id=CVE-2016-2107
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. La implementación de AES-NI en OpenSSL en versiones anteriores a 1.0.1t y 1.0.2 en versiones anteriores a 1.0.2h no considera la asignación de memoria durante una comprobación de relleno determinada, lo que permite a atacantes remotos obtener información de texto claro sensible a través de un ataque de padding-oracle contra una sesión AES CBC . NOTA: esta vulnerabilidad existe debido a una corrección incorrecta para CVE-2013-0169. It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. • https://www.exploit-db.com/exploits/39768 https://github.com/FiloSottile/CVE-2016-2107 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html http://lists.opensuse.org/opensuse-security • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 89%CPEs: 40EXPL: 0CVE-2016-2108 – openssl: Memory corruption in the ASN.1 encoder
https://notcve.org/view.php?id=CVE-2016-2108
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. La implementación ASN.1 en OpenSSL en versiones anteriores a 1.0.1o y 1.0.2 en versiones anteriores a 1.0.2c permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (desbordamiento inferior de buffer y corrupción de memoria) a través de un campo ANY en datos serializados manipulados, también conocido como el problema "cero negativo". A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2016-05/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2016-1660 – chromium-browser: out-of-bounds write in blink
https://notcve.org/view.php?id=CVE-2016-1660
Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site. Blink, tal como se utiliza en Google Chrome en versiones anteriores a 50.0.2661.94, no maneja correctamente las aserciones en las clases WTF::BitArray y WTF::double_conversion::Vector, lo que permite a atacantes remotos provocar una denegación de servicio (escritura fuera de límites) o posiblemente tener otro impacto no especificado a través de un sitio web manipulado. • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html http://rhn.redhat.com/errata/RHSA-2016-0707.html http://www.debian.org/security/2016/dsa-3564 http://www.securityfocus.co • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2016-1663 – chromium-browser: use-after-free in blink's v8 bindings
https://notcve.org/view.php?id=CVE-2016-1663
The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94, mishandles certain array-buffer data structures, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site. La función SerializedScriptValue::transferArrayBuffers en WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp en los enlaces V8 en Blink, tal como se utiliza en Google Chrome en versiones anteriores a 50.0.2661.94, no maneja correctamente determinadas estructuras de datos array-buffer, lo que permite a atacantes remotos provocar una denegación de servicio (uso después de liberación de memoria) o posiblemente tener otro impacto no especificado a través de un sitio web manipulado. • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html http://rhn.redhat.com/errata/RHSA-2016-0707.html http://www.debian.org/security/2016/dsa-3564 http://www.securityfocus.co •
CVSS: 8.3EPSS: 0%CPEs: 6EXPL: 0CVE-2016-1661 – chromium-browser: memory corruption in cross-process frames
https://notcve.org/view.php?id=CVE-2016-1661
Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site, related to BindingSecurity.cpp and DOMWindow.cpp. Blink, tal como se utiliza en Google Chrome en versiones anteriores a 50.0.2661.94, no asegura que los marcos satisfagan una comprobación para el mismo proceso de renderización en adición a una comprobación de la Same Origin Policy, lo que permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) o posiblemente tener otro impacto no especificado a través de sitio web manipulado, relacionado con BindingSecurity.cpp y DOMWindow.cpp. • http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00048.html http://rhn.redhat.com/errata/RHSA-2016-0707.html http://www.debian.org/security/2016/dsa-3564 http://www.securityfocus.co • CWE-20: Improper Input Validation •