OpenSSL TLS Missing SRP Extension Denial of Service (CVE-2014-5139)

A denial of service vulnerability has been reported in OpenSSL. The vulnerability is due to an issue while parsing Server Hello messages with a specific cipher suite and extension. A remote unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to a target...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2015:0077-2)

MozillaFirefox was updated to version 35.0 bnc910669 Notable features : - Firefox Hello with new rooms-based conversations model - Implemented HTTP Public Key Pinning Extension for enhanced authentication of encrypted connections Security fixes : - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635...

Security update for MozillaFirefox (important)

MozillaFirefox was updated to version 35.0 bnc910669 Notable features: Firefox Hello with new rooms-based conversations model Implemented HTTP Public Key Pinning Extension for enhanced authentication of encrypted connections Security fixes: MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous...

UBUNTU-CVE-2014-3569

The ssl23getclienthello function in s23srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an unexpected handshake, as demonstrated by...

DEBIAN-CVE-2014-3569

The ssl23getclienthello function in s23srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an unexpected handshake, as demonstrated by...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2014:1581-1)

This MozillaFirefox update fixes several security and non security issues. Changes in MozillaFirefox : - update to Firefox 34.0.5 bnc908009 - Default search engine changed to Yahoo! for North America - Default search engine changed to Yandex for Belarusian, Kazakh, and Russian locales - Improved...

CVE-2014-5695

The Hello Kitty Cafe aka com.sd.google.helloKittyCafe application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Hello Kitty Cafe aka com.sd.google.helloKittyCafe application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5695

The Hello Kitty Cafe aka com.sd.google.helloKittyCafe application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5695

The CVE-2014-5695 entry affects the Android app Hello Kitty Cafe (com.sd.google.helloKittyCafe) version 1.4.0, where SSL certificate verification is not performed for servers. This allows a man-in-the-middle to spoof servers and capture sensitive information via a crafted certificate. The core ca...

openssl: DoS when sending invalid DTLS handshake

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash...

openssl: race condition in ssl_parse_serverhello_tlsext

A race condition was found in the way OpenSSL handled ServerHello messages with an included Supported EC Point Format extension. A malicious server could possibly use this flaw to cause a multi-threaded TLS/SSL client using OpenSSL to write into freed memory, causing the client to crash or execut...

DEBIAN-CVE-2014-5139

The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service NULL pointer dereference and client application crash via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite...

openssl security update

1.0.1e-34.4 - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3509 - fix race condition when parsing serve...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2308-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2308-1 advisory. Adam Langley and Wan-Teh Chang discovered that OpenSSL incorrectly handled certain DTLS packets. A remote attacker could use this issue to cause OpenSSL ...

UBUNTU-CVE-2014-3509

Race condition in the sslparseserverhellotlsext function in t1lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service memory overwrite and client application crash or possibly have...

openssl: DoS when sending invalid DTLS handshake

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash...

Vulnerability in OpenSSL - Crash with SRP ciphersuite in Server Hello message

A crash was found affecting SRP ciphersuites used in a Server Hello message. The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference read by specifying an SRP ciphersuite even though it was not properly negotiated with the client. This...

LightsOut/Hello Exploit Kit (CVE-2013-2465)

LightsOut/Hello is an exploit kit that operates by delivering malicious payload to the victim's computer. Remote attackers can infect users by enticing them to visit a malicious web page. Successful infection will allow the attacker to download additional malware to the target...

SOL15343 - OpenSSL vulnerability CVE-2014-0221

The dtls1getmessagefragment function in d1both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service recursion and client crash via a DTLS hello message in an invalid DTLS handshake. CVE-2014-0221...