Debian DSA-3566-1 : openssl - security update

Several vulnerabilities were discovered in OpenSSL, a Secure Socket Layer toolkit. - CVE-2016-2105 Guido Vranken discovered that an overflow can occur in the function EVPEncodeUpdate, used for Base64 encoding, if an attacker can supply a large amount of data. This could lead to a heap corruption....

CVE-2016-2106

CVE-2016-2106 affects OpenSSL: an integer overflow in EVP_EncryptUpdate can overflow a heap buffer when processing very large inputs, enabling remote denial of service or crash. Affected versions include OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h; mitigations in public advisories recommend upg...

OpenSSL 1.0.2 < 1.0.2h Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2h. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2h advisory. - The X509NAMEoneline function in crypto/x509/x509obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to...

Security fix for the ALT Linux 7 package openssl10 version 1.0.1t-alt0.M70P.1

1.0.1t-alt0.M70P.1 built May 4, 2016 Gleb Fotengauer-Malinovskiy in task 164219 May 3, 2016 Gleb Fotengauer-Malinovskiy - Updated to 1.0.1t fixes CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176...

Ubuntu: Security Advisory (USN-2959-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security fix for the ALT Linux 8 package openssl10 version 1.0.2h-alt1

1.0.2h-alt1 built May 4, 2016 Gleb Fotengauer-Malinovskiy in task 164216 May 3, 2016 Gleb Fotengauer-Malinovskiy - Updated to 1.0.2h fixes CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176...

[SECURITY] [DSA 3566-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3566-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini May 03, 2016 https://www.debian.org/security/faq -...

SUSE-SU-2016:1206-1 Security update for openssl1

This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2016-2108: Memory corruption in the ASN.1 encoder bsc977617 - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check bsc977616 - CVE-2016-2105: EVPEncodeUpdate overflow bsc977614 - CVE-2016-2106: EVPEncryptUpdate...

Internet Bug Bounty: EVP_EncryptUpdate overflow (CVE-2016-2106)

https://github.com/openssl/openssl/commit/3f3582139fbb259a1c3cbb0a25236500a409bf26...

Security fix for the ALT Linux 9 package openssl10 version 1.0.2h-alt1

May 3, 2016 Gleb Fotengauer-Malinovskiy 1.0.2h-alt1 - Updated to 1.0.2h fixes CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176...

Security fix for the ALT Linux 10 package openssl1.1 version 1.0.2h-alt1

May 3, 2016 Gleb Fotengauer-Malinovskiy 1.0.2h-alt1 - Updated to 1.0.2h fixes CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2109 CVE-2016-2176...

CVE-2016-2106

Integer overflow in the EVPEncryptUpdate function in crypto/evp/evpenc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service heap memory corruption via a large amount of data...

Important: openssl

Issue Overview: A vulnerability was discovered that allows a man-in-the-middle attacker to use a padding oracle attack to decrypt traffic on a connection using an AES CBC cipher with a server supporting AES-NI. CVE-2016-2107, Important It was discovered that the ASN.1 parser can misinterpret a...

CVE-2015-2106

HP Integrated Lights-Out (iLO) firmware CVE-2015-2106 affects iLO 2 before 2.27, iLO 3 before 1.82, and iLO 4 before 2.10. The vulnerability is described as unspecified, allowing remote attackers to bypass access restrictions or cause a denial of service via unknown vectors. No concrete exploit d...

Cisco IOS Software Session Initiation Protocol Denial of Service (cisco-sa-20140326-sip)

According to its self-reported version, the version of Cisco IOS running on the remote host is affected by a denial of service vulnerability in the Session Initiation Protocol SIP implementation. An unauthenticated, remote attacker could potentially exploit this issue to cause a denial of service...

Cisco IOS软件会话初始协议拒绝服务漏洞

CVECAN ID: CVE-2014-2106 Cisco IOS是多数思科系统路由器和网络交换机上使用的互联网络操作系统。 Cisco IOS 15.3M、IOS XE 3.10.xS在处理特制的SIP消息时存在错误，可导致内存资源耗尽，以及设备重载。 0 Cisco IOS XE 3.x Cisco已经为此发布了一个安全公告（cisco-sa-20140326-sip）以及相应补丁: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip...

CVE-2014-2106

CVE-2014-2106 affects Cisco IOS 15.3M before 15.3(3)M2 and IOS XE 3.10.xS before 3.10.2S. A crafted SIP message may cause the device to reload (DoS) on unauthenticated remote access. The issue is documented in Cisco advisory cisco-sa-20140326-sip; affected versions and mitigation are provided by ...

UBUNTU-CVE-2012-2106

Integer overflow in the pvimport function in util/pvimport.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow...

CVE-2012-2106

Integer overflow in the pvimport function in util/pvimport.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow...

CVE-2012-2106

CVE-2012-2106 affects Csound 5.16.6, where an integer overflow in pv_import.c during file conversion enables a heap-based buffer overflow that could allow remote code execution. Several advisories reference the same issue and market it as a remote vulnerability (exploitable via crafted files). Re...