QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2015-7940

Back to search

CVE-2015-7940

Published: Nov 9, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

VendorProductVersions

n/a

n/a

affected
n/a

References

RHSA-2016:2035
vendor-advisory
x_refsource_REDHAT
79091
vdb-entry
x_refsource_BID
openSUSE-SU-2015:1911
vendor-advisory
x_refsource_SUSE
FEDORA-2015-7d95466eda
vendor-advisory
x_refsource_FEDORA
RHSA-2016:2036
vendor-advisory
x_refsource_REDHAT
USN-3727-1
vendor-advisory
x_refsource_UBUNTU
1037036
vdb-entry
x_refsource_SECTRACK
DSA-3417
vendor-advisory
x_refsource_DEBIAN
1037046
vdb-entry
x_refsource_SECTRACK
1037053
vdb-entry
x_refsource_SECTRACK

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now