Dan Boneh

**Nome do software vulnerável e versões afetadas: Versões do Zcashd anteriores à 2.1.1-1 Descrição: A vulnerabilidade permite que um invasor aproveite o deslocamento de tempo entre mensagens para obter informações confidenciais sobre a relação entre o endereço de uma vítima suspeita e um endereço IP, utilizando um canal lateral de tempo. Recomendações: Para versões anteriores à 2.1.1-1, atualize para a versão 2.1.1-1 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 41.0.2272.76 **Description** The issue allows remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for `ondeviceorientation` events. This is achieved by not properly restricting access to high-rate gyroscope data. **Recommendations** For versions prior to 41.0.2272.76, update to version 41.0.2272.76 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 20.0.1132.43 **Description** The issue allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain. **Recommendations** For versions prior to 20.0.1132.43, update to version 20.0.1132.43 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 0.9.5a through 0.9.6b **Description** The issue concerns multiple vulnerabilities in the OpenSSL package of Red Hat Linux, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited by determining factors using timing differences on the number of extra reductions during Montgomery reduction and the use of different integer multiplication algorithms. **Recommendations** For versions 0.9.5a through 0.9.6b, consider disabling the use of RSA blinding by default as a temporary workaround until a patch is available. Restrict access to sensitive information and minimize the risk of exploitation by limiting remote access to the affected systems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.