Most recent entries from all

bdu:2019-00768

certfr-2018-ale-001 — \[Mise à jour du 25/05/2018 : ajout de bulletins Microsoft (cf. section Documentation)\] \[Mi…

certfr-2018-ale-001

certfr-2018-avi-248 — Une vulnérabilité a été découverte dans le noyau Linux de RedHat. Elle permet à un attaquant de provoquer une atteinte…
certfr-2018-avi-248

cisco-sa-20180521-cpusidechannel — CPU Side-Channel Information Disclosure Vulnerabilities: May 2018

On May 21, 2018, researchers disclosed two vulnerabilities that take advantage of the implementation of speculative execution of instructions on many modern microprocessor architectures to perform side-channel information disclosure attacks. These vulnerabilities could allow an unprivileged, local attacker, in specific circumstances, to read privileged memory belonging to other processes. The first vulnerability, CVE-2018-3639, is known as Spectre Variant 4 or SpectreNG. The second vulnerability, CVE-2018-3640, is known as Spectre Variant 3a. Both of these attacks are variants of the attacks disclosed in January 2018 and leverage cache-timing attacks to infer any disclosed data. To exploit either of these vulnerabilities, an attacker must be able to run crafted or script code on an affected device. Although the underlying CPU and operating system combination in a product or service may be affected by these vulnerabilities, the majority of Cisco products are closed systems that do not allow customers to run custom code and are, therefore, not vulnerable. There is no vector to exploit them. Cisco products are considered potentially vulnerable only if they allow customers to execute custom code side-by-side with Cisco code on the same microprocessor. A Cisco product that may be deployed as a virtual machine or a container, even while not directly affected by any of these vulnerabilities, could be targeted by such attacks if the hosting environment is vulnerable. Cisco…

CLEANSTART-2026-JY98800 — Security fix for CVE-2018-3639 applied in: openjdk8 8.181.13-r0

Affected: CleanStart: openjdk8

Security vulnerability affects the openjdk8 package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2018-13391
cnvd-2018-13391

EUVD-2026-323010
EUVD-2026-323010

fkie_cve-2018-3639

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

gsd-2018-3639
gsd-2018-3639

openSUSE-SU-2019:1438-1 — Security update for java-1_8_0-openjdk

Security update for java-1_8_0-openjdk

RHSA-2018:1630 — Red Hat Security Advisory: kernel-rt security update

hw: cpu: speculative store bypass

SUSE-SU-2018:1362-1 — Security update for qemu

Security update for qemu

UBUNTU-CVE-2018-3639

Affected: Ubuntu:14.04:LTS: intel-microcode, Ubuntu:14.04:LTS: libvirt, Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-aws, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:14.04:LTS: qemu, Ubuntu:16.04:LTS: intel-microcode, Ubuntu:16.04:LTS: libvirt, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws and 25 more

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

WID-SEC-W-2023-2072 — Prozessoren verschiedener Hersteller: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Ein lokaler Angreifer kann mehrere Schwachstellen in Prozessoren unterschiedlicher Hersteller ausnutzen, um Sicherheitsvorkehrungen zu umgehen.