198 matches found
Security Bulletin: Vulnerability in OpenSSL affects FlashCopy Manager shipped with IBM® Db2® LUW (CVE-2017-3738, CVE-2017-3737).
Summary Security vulnerabilities have been identified in OpenSSL that affect IBM Tivoli Storage FlashCopy Manager FCM shipped as a component of IBM Db2. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an...
Security Bulletin: Vulnerabilities in libXpm, libXdmcp, and libICE affect PowerKVM
Summary PowerKVM is affected by vulnerabilities in libXpm, libXdmcp, and libICE . IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2...
Security Bulletin: Security vulnerabilities in OpenSSL used by IBM PureApplication Systems ( CVE-2017-3737 CVE-2017-3738)
Summary OpenSSL, used by the IBM PureApplication System, has security vulnerabilities were disclosed by OpenSSL project. The following vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2017-3737 DESCRIPTION: An unspecified vulnerability in multiple Oracle products could allow ...
[R1] Nessus Agent 7.1.0 Fixes Multiple Third-party Vulnerabilities
Nessus Agent leverages third-party software to help provide underlying functionality. Some of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade t...
CVE-2018-3738
protobufjs is affected by a Denial of Service via a regular expression denial of service when parsing crafted invalid .proto files. Affected versions are prior to 5.0.3 and prior to 6.8.6. Remediation: upgrade to protobufjs 5.0.3 or later, or 6.8.6 or later. The issue arises from ReDoS during par...
CVE-2018-3738
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...
Scientific Linux Security Update : openssl on SL7.x x86_64 (20180410)
Security Fixes : - openssl: bnsqrx8xinternal carry bug on x8664 CVE-2017-3736 - openssl: Read/write after SSL object in error state CVE-2017-3737 - openssl: rsaz1024mulavx2 overflow bug on x8664 CVE-2017-3738 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientif...
Juniper NSM < 2012.2R14 OpenSSL Multiple Vulnerabilities (JSA10851)
The remote host is running a version of NSM Network and Security Manager Server that is prior to 2012.2R14. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
CentOS 7 : openssl (CESA-2018:0998)
An update for openssl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
openssl security update
1.0.2k-12.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-12 - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus 1.0.2k-11 - fix deadlock in RNG in the FIPS mode in mariadb...
openssl security and bug fix update
1.0.2k-12.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-12 - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus 1.0.2k-11 - fix deadlock in RNG in the FIPS mode in mariadb...
[ASA-201804-6] lib32-openssl: private key recovery
Arch Linux Security Advisory ASA-201804-6 ========================================= Severity: Medium Date : 2018-04-15 CVE-ID : CVE-2017-3738 Package : lib32-openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-551 Summary ======= The package lib32-openssl...
RHEL 7 : openssl (RHSA-2018:0998)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0998 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...
[ASA-201804-2] openssl: multiple issues
Arch Linux Security Advisory ASA-201804-2 ========================================= Severity: Medium Date : 2018-04-01 CVE-ID : CVE-2017-3738 CVE-2018-0739 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-540 Summary ======= The package openssl befor...
Debian DSA-4157-1 : openssl - security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3738 David Benjamin of Google reported an overflow bug in the AVX2 Montgomery multiplication procedure used in...
[SECURITY] [DSA 4157-1] openssl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4157-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2018 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4157-1] openssl security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4157-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 29, 2018 https://www.debian.org/security/faq -...
FreeBSD : OpenSSL -- multiple vulnerabilities (b7cff5a9-31cc-11e8-8f07-b499baebfeaf)
The OpenSSL project reports : - Constructed ASN.1 types with a recursive definition could exceed the stack CVE-2018-0739 Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given malicious input with excessive recursion. This could...
Solaris 10 (x86) : 121230-02
SunOS 5.10x86: libssl patch. Date this patch was last updated by Sun : Apr/23/07 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if description...
