New upstream release fixing CVE-2015-7511 low impact security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libgcrypt packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

    This update was imported from the SUSE:SLE-12:Update     update project.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

GnuPG reports :

Mitigate side-channel attack on ECDH with Weierstrass curves.

This update for libgcrypt fixes the following issues :

  - CVE-2015-7511: side-channel attack on ECDH with     Weierstrass curves (boo#965902)

The remote host is affected by the vulnerability described in GLSA-201610-04 (libgcrypt: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libgcrypt. Please       review the CVE identifiers referenced below for details.
  Impact :

    Side-channel attacks can leak private key information. A separate       critical bug allows an attacker who obtains 4640 bits from the RNG to       trivially predict the next 160 bits of output.
  Workaround :

    There is no known workaround at this time.

libgcrypt was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-7511: Side-channel attack on ECDH with     Weierstrass curves (bsc#965902).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt11 library could be leaked via a side-channel attack.

See https://www.cs.tau.ac.IL/~tromer/ecdh/ for details.

Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
92535	Fedora 24 : libgcrypt (2016-83cd045bcc)	Nessus	Fedora Local Security Checks	7/25/2016	1/11/2021	low
88911	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : libgcrypt (SSA:2016-054-03)	Nessus	Slackware Local Security Checks	2/24/2016	1/14/2021	low
90911	openSUSE Security Update : libgcrypt (openSUSE-2016-559)	Nessus	SuSE Local Security Checks	5/5/2016	1/19/2021	low
88725	Debian DSA-3474-1 : libgcrypt20 - security update	Nessus	Debian Local Security Checks	2/15/2016	1/11/2021	low
88744	FreeBSD : libgcrypt -- side-channel attack on ECDH (95b92e3b-d451-11e5-9794-e8e0b747a45a)	Nessus	FreeBSD Local Security Checks	2/16/2016	1/4/2021	low
88979	openSUSE Security Update : libgcrypt (openSUSE-2016-267)	Nessus	SuSE Local Security Checks	2/26/2016	1/19/2021	low
92769	Fedora 23 : libgcrypt (2016-ec4c27d766)	Nessus	Fedora Local Security Checks	8/8/2016	1/11/2021	low
93946	GLSA-201610-04 : libgcrypt: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/11/2016	1/11/2021	medium
90587	SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2016:1089-1)	Nessus	SuSE Local Security Checks	4/19/2016	1/6/2021	low
88741	Debian DSA-3478-1 : libgcrypt11 - security update	Nessus	Debian Local Security Checks	2/16/2016	1/11/2021	low
88747	Ubuntu 14.04 LTS : Libgcrypt vulnerability (USN-2896-1)	Nessus	Ubuntu Local Security Checks	2/16/2016	10/20/2023	low

Detections

Analytics

Plugins Search

low

low

low

low

low

low

low

medium

low

low

low