Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-4551 State: PUBLISHED Published: 2013-11-15T18:16:00 Last Updated: 2024-08-06T16:45:14.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution." Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/88649 - http://www.securityfocus.com/bid/63625 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://www.securitytracke
http://www.securityfocus.com/bid/63625 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://www.securitytracker.com/id/1029313 - http://secunia.com/advisories/55398 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html - http://www.openwall.com/lists/oss-security/2013/11/11/1
CVE ID: CVE-2013-4552 State: PUBLISHED Published: 2014-05-13T15:00:00 Last Updated: 2024-08-06T16:45:14.847Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie. Additional Analyst Notes: - CVE Program Container: References: - https://code.google.com/p/drupalauth/issues/detail?id=9 - http://www.openwall.com/lists/oss-security/2013/11/05/1 - http://www.openwall.com/lists/oss-security/2013/11/08/6
CVE ID: CVE-2013-4553 State: PUBLISHED Published: 2013-12-24T19:00:00 Last Updated: 2024-08-06T16:45:14.806Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock). Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/11/26/8 - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-se
xml - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://www.debian.org/security/2014/dsa-3006 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
CVE ID: CVE-2013-4554 State: PUBLISHED Published: 2013-12-24T19:00:00 Last Updated: 2024-08-06T16:45:15.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html - http://rhn.redhat.com/errata/RHSA-2014-0285.html - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://www.openwall.com/lists/oss-security/
a/RHSA-2014-0285.html - http://security.gentoo.org/glsa/glsa-201407-03.xml - http://www.openwall.com/lists/oss-security/2013/11/26/9 - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
CVE ID: CVE-2013-4555 State: PUBLISHED Published: 2013-11-15T18:16:00 Last Updated: 2024-08-06T16:45:14.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2013/dsa-2794 - http://www.spip.net/fr_article5646.html - http://www.securitytracker.com/id/1029317 - http://core.spip.org/projects/spip/repository/revisions/20874 - http://www.openwall.com/lists/oss-securi
om/id/1029317 - http://core.spip.org/projects/spip/repository/revisions/20874 - http://www.openwall.com/lists/oss-security/2013/11/10/4 - http://secunia.com/advisories/55551
CVE ID: CVE-2013-4556 State: PUBLISHED Published: 2013-11-15T18:16:00 Last Updated: 2024-08-06T16:45:15.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2013/dsa-2794 - http://core.spip.org/projects/spip/repository/revisions/20880 - http://www.spip.net/fr_article5646.html - http://www.securitytracker.com/id/1029317 - http://www.openwall.com/lists/oss-
http://www.spip.net/fr_article5646.html - http://www.securitytracker.com/id/1029317 - http://www.openwall.com/lists/oss-security/2013/11/10/4 - http://secunia.com/advisories/55551 - http://www.spip.net/fr_article5648.html - http://core.spip.org/projects/spip/repository/revisions/20879
CVE ID: CVE-2013-4557 State: PUBLISHED Published: 2013-11-15T18:16:00 Last Updated: 2024-08-06T16:45:14.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2013/dsa-2794 - http://www.spip.net/fr_article5646.html - http://www.securitytracker.com/id/1029317 - http://www.openwall.com/lists/oss-security/2013/11/10/4 - http://secunia.com/advisories/55551 - http://www.spip.net/fr_article5648.html - ht
com/lists/oss-security/2013/11/10/4 - http://secunia.com/advisories/55551 - http://www.spip.net/fr_article5648.html - http://zone.spip.org/trac/spip-zone/changeset/75105/_core_/securite/ecran_securite.php
CVE ID: CVE-2013-4558 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T16:45:14.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1033431 - http://subversion.apache.
: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1033431 - http://subversion.apache.org/security/CVE-2013-4558-advisory.txt - http://osvdb.org/100363 - http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html - https://github.com/apache/subversion/commit/2c77c43e4255555f3b79f761f0d141393a3856cc - https://github.com/apache/subversion/commit/647e3f8365a74831bb915f63793b63e31fae062d
CVE ID: CVE-2013-4559 State: PUBLISHED Published: 2013-11-19T19:00:00 Last Updated: 2024-08-06T16:45:14.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55682 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://download.lighttpd.net/lig
tp://secunia.com/advisories/55682 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt - http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html - https://www.debian.org/security/2013/dsa-2795 - http://www.openwall.com/lists/oss-security/2013/11/12/4 - https://kc.mcafee.com/corporate/index?page=content&id=SB10310 - http://jvn.jp/en/jp/JVN37417423/index.html
CVE ID: CVE-2013-4560 State: PUBLISHED Published: 2013-11-19T19:00:00 Last Updated: 2024-08-06T16:45:14.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55682 - http://marc.info/?l=bugtraq&m=141576815022399&w=2 - http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt - http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html - https://www.debian.org/security
ttpd_sa_2013_03.txt - http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html - https://www.debian.org/security/2013/dsa-2795 - http://www.openwall.com/lists/oss-security/2013/11/12/4 - http://jvn.jp/en/jp/JVN37417423/index.html
CVE ID: CVE-2013-4561 State: PUBLISHED Published: 2022-06-30T18:40:58 Last Updated: 2024-08-06T16:45:15.230Z Vendors: n/a Products: openshift-origin-msg-node-mcollective Problem Types: CWE-377 Description: In a openshift node, there is a cron job to update mcollective facts that mishandles a temporary file. This may lead to loss of confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1029652 - https://github.com/openshift/origin-server/commit/f1abe972794e35a4bfba597694ce829990f14d39
CVE ID: CVE-2013-4562 State: PUBLISHED Published: 2014-05-13T15:00:00 Last Updated: 2024-08-06T16:45:14.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/264 - http://www.osvdb.org/99693 - https://github.com/mkdynamic/omniauth-facebook/commit/ccfcc26fe7e34acbd75ad4a095fd01ce5ff48ee7 - https://groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ - http://osvdb.org/ref/9
a095fd01ce5ff48ee7 - https://groups.google.com/d/msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ - http://osvdb.org/ref/99/omniauth-facebook_gem.txt - http://seclists.org/oss-sec/2013/q4/267
CVE ID: CVE-2013-4563 State: PUBLISHED Published: 2013-11-19T15:00:00 Last Updated: 2024-08-06T16:45:15.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2113-1 - http://git.kernel.org/?p=li
Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2113-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0e033e04c2678dbbe74a46b23fffb7bb918c288e - http://www.ubuntu.com/usn/USN-2117-1 - https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288e - https://bugzilla.redhat.com/show_bug.cgi?id=1030015 - http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html - http://www.openwall.com/lists/oss-security/2013/11/13/9
CVE ID: CVE-2013-4564 State: PUBLISHED Published: 2014-01-07T17:00:00 Last Updated: 2024-08-06T16:45:14.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/56276 - https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124928.html - https://libreswan.org/security/CVE-2013-4564/CVE-2013-4564.txt.asc - http://lists.fedoraproject.org/pipe
r/124928.html - https://libreswan.org/security/CVE-2013-4564/CVE-2013-4564.txt.asc - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124943.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124911.html
CVE ID: CVE-2013-4565 State: PUBLISHED Published: 2014-04-25T17:00:00 Last Updated: 2024-08-06T16:45:15.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the __OLEdecode function in ppthtml 0.5.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted .ppt file. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729279 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88885 - http://seclists.org/oss-sec/2013/q4/279
CVE ID: CVE-2013-4566 State: PUBLISHED Published: 2013-12-12T18:00:00 Last Updated: 2024-08-06T16:45:15.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1016832 - http://rhn.redhat.com/errata/RHSA-2013-1779.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html
CVE ID: CVE-2013-4567 State: PUBLISHED Published: 2013-12-13T18:00:00 Last Updated: 2024-08-06T16:45:14.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/63760 - http://secunia.com/advisories/57472 - http://www.debian.org/security/2014/dsa-2891 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html - http://lists.fe
rity/2014/dsa-2891 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
CVE ID: CVE-2013-4568 State: PUBLISHED Published: 2013-12-13T18:00:00 Last Updated: 2024-08-06T16:45:14.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57472 - http://www.debian.org
tional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/57472 - http://www.debian.org/security/2014/dsa-2891 - https://bugzilla.wikimedia.org/attachment.cgi?id=13452&action=diff - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://www.securityfocus.com/bid/63761 - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=55332
CVE ID: CVE-2013-4569 State: PUBLISHED Published: 2013-12-13T18:00:00 Last Updated: 2024-08-06T16:45:14.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://lists
ovember/000135.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=54294
CVE ID: CVE-2013-4570 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T16:45:15.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html - https://bugzill
tainer: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=54527
CVE ID: CVE-2013-4571 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T16:45:14.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE ID: CVE-2013-4572 State: PUBLISHED Published: 2020-02-06T14:40:13 Last Updated: 2024-08-06T16:45:15.240Z Vendors: Wikimedia Foundation Products: MediaWiki Problem Types: Other Description: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.wikimedia.org/show_bug.cgi?id=53032 - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://lists.fedoraproject.org/pipermail/packag
fedoraproject.org/pipermail/package-announce/2013-December/123011.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-December/122998.html - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html
CVE ID: CVE-2013-4573 State: PUBLISHED Published: 2013-11-25T19:00:00 Last Updated: 2024-08-06T16:45:14.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.wikimedia.org/show_bug.cgi?id=55991 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html - http://secunia.com/advisories/55754
CVE ID: CVE-2013-4574 State: PUBLISHED Published: 2014-05-12T14:00:00 Last Updated: 2024-08-06T16:45:14.842Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos. Additional Analyst Notes: - CVE Program Container: References: - http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
CVE ID: CVE-2013-4575 State: PUBLISHED Published: 2013-08-04T20:00:00 Last Updated: 2024-08-06T16:45:15.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 - http://osvdb.org/95938 - http://www.securityfocus.com/bid/614
y_advisory&pvid=security_advisory&year=&suid=20130801_00 - http://osvdb.org/95938 - http://www.securityfocus.com/bid/61485
CVE ID: CVE-2013-4576 State: PUBLISHED Published: 2013-12-20T21:00:00 Last Updated: 2024-08-06T16:45:14.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for t
ity of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/64424 - http://www.ubuntu.com/usn/USN-2059-1 - http://osvdb.org/101170 - http://lists.gnupg.org/pipermail/gnupg-devel/2013-December/028102.html - http://rhn.redhat.com/errata/RHSA-2014-0016.html - http://www.securitytracker.com/id/1029513 - https://exchange.xforce.ibmcloud.com/vulnerabilitie
ta/RHSA-2014-0016.html - http://www.securitytracker.com/id/1029513 - https://exchange.xforce.ibmcloud.com/vulnerabilities/89846 - http://www.debian.org/security/2013/dsa-2821 - http://www.tau.ac.il/~tromer/papers/acoustic-20131218.pdf - http://seclists.org/oss-sec/2013/q4/523 - http://www.cs.tau.ac.il/~tromer/acoustic/ - http://seclists.org/oss-sec/2013/q4/520