CVE-2015-7940

Published: Nov 9, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

Affected (12)

Products: Opensuse: Leap, Opensuse · Bouncycastle: Bouncy Castle Crypto Package · Oracle: Application Testing Suite, Enterprise Manager Ops Center, Peoplesoft Enterprise Peopletools, Virtual Desktop Infrastructure

2 products

1 product

Bouncy Castle Crypto Package

4 products

Application Testing Suite

Enterprise Manager Ops Center

Peoplesoft Enterprise Peopletools

Virtual Desktop Infrastructure

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Bouncycastle Bouncy Castle Crypto Package	Up to 1.50

Configuration C

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Testing Suite	Version 12.5.0.1
Oracle Application Testing Suite	Version 12.5.0.2
Oracle Application Testing Suite	Version 12.5.0.3
Oracle Enterprise Manager Ops Center	Version 12.1.4
Oracle Enterprise Manager Ops Center	Version 12.2.2
Oracle Peoplesoft Enterprise Peopletools	Version 8.54
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Virtual Desktop Infrastructure	Version 3.5.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (42)

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174915.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00012.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2035.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-2036.html

Source: cve@mitre.org

http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html

Source: cve@mitre.org

Technical Description

http://www.debian.org/security/2015/dsa-3417

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/10/22/7

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2015/10/22/9

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: cve@mitre.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: cve@mitre.org

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/79091

Source: cve@mitre.org

http://www.securitytracker.com/id/1037036

Source: cve@mitre.org

http://www.securitytracker.com/id/1037046

Source: cve@mitre.org

http://www.securitytracker.com/id/1037053

Source: cve@mitre.org

https://usn.ubuntu.com/3727-1/

Source: cve@mitre.org

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174915.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2035.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-2036.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html

Source: af854a3a-2127-422b-91ae-364da2661108

Technical Description

http://www.debian.org/security/2015/dsa-3417

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2015/10/22/7

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2015/10/22/9

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/79091

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1037036

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1037046

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1037053

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/3727-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.