ALT-BU-2016-2567-3
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2015-0886
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
- http://jvn.jp/en/jp/JVN77718330/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000033
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151786.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151797.html
- http://www.mindrot.org/projects/jBCrypt/news/rel04.html
- https://bugzilla.mindrot.org/show_bug.cgi?id=2097
- https://lists.apache.org/thread.html/rbd23e3ac8113b4da0a025c0e45170b6ec317383a1cf06090c2c717aa%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/rd5c2256b8dc9935e4bb5e9be90adce58408054bb42523730a40c5548%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/re330cfe9e5d84e3f7da8ace23ec32f38cb3fbd328bf177badd7ad942%40%3Ccommits.cassandra.apache.org%3E
- http://jvn.jp/en/jp/JVN77718330/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000033
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151786.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151797.html
- http://www.mindrot.org/projects/jBCrypt/news/rel04.html
- https://bugzilla.mindrot.org/show_bug.cgi?id=2097
- https://lists.apache.org/thread.html/rbd23e3ac8113b4da0a025c0e45170b6ec317383a1cf06090c2c717aa%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/rd5c2256b8dc9935e4bb5e9be90adce58408054bb42523730a40c5548%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/re330cfe9e5d84e3f7da8ace23ec32f38cb3fbd328bf177badd7ad942%40%3Ccommits.cassandra.apache.org%3E
Modified: 2022-07-06
GHSA-9h6p-92jq-888x
Integer Overflow or Wraparound in JBCrypt
- https://nvd.nist.gov/vuln/detail/CVE-2015-0886
- https://bugzilla.mindrot.org/show_bug.cgi?id=2097
- https://lists.apache.org/thread.html/rbd23e3ac8113b4da0a025c0e45170b6ec317383a1cf06090c2c717aa@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/rd5c2256b8dc9935e4bb5e9be90adce58408054bb42523730a40c5548@%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/re330cfe9e5d84e3f7da8ace23ec32f38cb3fbd328bf177badd7ad942@%3Ccommits.cassandra.apache.org%3E
- http://jvn.jp/en/jp/JVN77718330/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000033
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151496.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151786.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151797.html
- http://www.mindrot.org/projects/jBCrypt/news/rel04.html
Closed vulnerabilities
Modified: 2021-03-23
BDU:2016-00609
Уязвимость криптографической библиотеки Nettle, позволяющая нарушителю повлиять на целостность, доступность и конфиденциальность информации
Modified: 2021-03-23
BDU:2016-00708
Уязвимость криптографической библиотеки Nettle, позволяющая нарушителю повлиять на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2021-03-23
BDU:2016-00709
Уязвимость криптографической библиотеки Nettle, позволяющая нарушителю повлиять на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-04-12
CVE-2015-8803
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176807.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177229.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177473.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
- https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003028.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176807.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177229.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177473.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
- https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003028.html
Modified: 2025-04-12
CVE-2015-8804
x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors.
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/fa269b6ad06dd13c901dbd84a12e52b918a09cd7
- https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003024.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/fa269b6ad06dd13c901dbd84a12e52b918a09cd7
- https://lists.gnu.org/archive/html/info-gnu/2016-01/msg00006.html
- https://lists.lysator.liu.se/pipermail/nettle-bugs/2015/003024.html
Modified: 2025-04-12
CVE-2015-8805
The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.securityfocus.com/bid/84272
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html
- http://rhn.redhat.com/errata/RHSA-2016-2582.html
- http://www.openwall.com/lists/oss-security/2016/02/02/2
- http://www.openwall.com/lists/oss-security/2016/02/03/1
- http://www.securityfocus.com/bid/84272
- http://www.ubuntu.com/usn/USN-2897-1
- https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html
- https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d
Package kernel-image-std-def updated to version 4.1.17-alt1 for branch sisyphus in task 157483.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2015-8816
The hub_activate function in drivers/usb/core/hub.c in the Linux kernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device.
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e50293ef9775c5f1cf3fcc093037dd6a8c5684ea
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://source.android.com/security/bulletin/2016-07-01.html
- http://www.debian.org/security/2016/dsa-3503
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.5
- http://www.openwall.com/lists/oss-security/2016/02/23/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
- http://www.securityfocus.com/bid/83363
- https://bugzilla.redhat.com/show_bug.cgi?id=1311589
- https://github.com/torvalds/linux/commit/e50293ef9775c5f1cf3fcc093037dd6a8c5684ea
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e50293ef9775c5f1cf3fcc093037dd6a8c5684ea
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://source.android.com/security/bulletin/2016-07-01.html
- http://www.debian.org/security/2016/dsa-3503
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.5
- http://www.openwall.com/lists/oss-security/2016/02/23/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
- http://www.securityfocus.com/bid/83363
- https://bugzilla.redhat.com/show_bug.cgi?id=1311589
- https://github.com/torvalds/linux/commit/e50293ef9775c5f1cf3fcc093037dd6a8c5684ea
