Dan Boneh

Name of the Vulnerable Software and Affected Versions: Zcashd versions prior to 2.1.1-1 Description: The issue allows an attacker to leverage the time offset between messages to obtain sensitive information about the relationship between a suspected victim's address and an IP address, utilizing a timing side channel. Recommendations: For versions prior to 2.1.1-1, update to version 2.1.1-1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 41.0.2272.76 **Description** The issue allows remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for `ondeviceorientation` events. This is achieved by not properly restricting access to high-rate gyroscope data. **Recommendations** For versions prior to 41.0.2272.76, update to version 41.0.2272.76 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 20.0.1132.43 **Description** The issue allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain. **Recommendations** For versions prior to 20.0.1132.43, update to version 20.0.1132.43 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 0.9.5a through 0.9.6b **Description** The issue concerns multiple vulnerabilities in the OpenSSL package of Red Hat Linux, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited by determining factors using timing differences on the number of extra reductions during Montgomery reduction and the use of different integer multiplication algorithms. **Recommendations** For versions 0.9.5a through 0.9.6b, consider disabling the use of RSA blinding by default as a temporary workaround until a patch is available. Restrict access to sensitive information and minimize the risk of exploitation by limiting remote access to the affected systems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.