CVE-2015-7940
09.11.2015, 16:59
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."Enginsight
| Vendor | Product | Version |
|---|---|---|
| opensuse | leap | 42.1 |
| opensuse | opensuse | 13.1 |
| opensuse | opensuse | 13.2 |
| bouncycastle | bouncy_castle_crypto_package | 𝑥 ≤ 1.50 |
| oracle | application_testing_suite | 12.5.0.1 |
| oracle | application_testing_suite | 12.5.0.2 |
| oracle | application_testing_suite | 12.5.0.3 |
| oracle | enterprise_manager_ops_center | 12.1.4 |
| oracle | enterprise_manager_ops_center | 12.2.2 |
| oracle | peoplesoft_enterprise_peopletools | 8.54 |
| oracle | peoplesoft_enterprise_peopletools | 8.55 |
| oracle | virtual_desktop_infrastructure | 3.5.2 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References