SUSE-SU-2022:3843-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2022-3358: Fixed vulnerability where a custom cipher passed to EVPCipherInit could lead into NULL encryption being unexpectedly used bsc1204226. - CVE-2022-3602: Fixed a buffer overflow in the X.509 email address. bsc1204714 -...

roaring-landmask (0.4.0) potentially affected by CVE-2022-3786 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-3786 Source advisory: OSV:RUSTSEC-2022-0065...

OpenSSL Releases Security Update

OpenSSL has released a security advisory to address two vulnerabilities, CVE-2022-3602 and CVE-2022-3786, affecting OpenSSL versions 3.0.0 through 3.0.6. Both CVE-2022-3602 and CVE-2022-3786 can cause a denial of service. According to OpenSSL, a cyber threat actor leveraging CVE-2022-3786, "can...

OpenSSL -- Buffer overflows in Email verification

The OpenSSL project reports: X.509 Email Address 4-byte Buffer Overflow CVE-2022-3602 High: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. X.509 Email Address Variable Length Buffer Overflow CVE-2022-3786 High: A buffer overrun can b...

OpenSSL 3.0.0 < 3.0.7 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.7 advisory. - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs...

CVE-2022-3786

OpenSSL CVE-2022-3602 and CVE-2022-3786 describe buffer overflows in X.509 name-constraint processing triggered by crafted email addresses in certificates, potentially crashing the TLS client/server and, in some scenarios, enabling remote code execution. Documents confirm the issues affect OpenSS...

OpenSSL 3.0.0 to 3.0.6 decodes some punycode email addresses in X.509 certificates improperly

Overview Two buffer overflow vulnerabilities were discovered in OpenSSL versions 3.0.0 through 3.0.6. These vulnerabilities were introduced in version 3.0.0 with the inclusion of support for punycode email address parsing for X.509 certificates. OpenSSL's assessment of the severity of the...

High severity vulnerabilities in OpenSSL 3.0

The OpenSSL project team released a security advisory for two high severity security issues affecting OpenSSL versions 3.0.0-3.0.6 and fixed in OpenSSL 3.0.7. The issues were assigned CVE-2022-3602 and CVE-2022-3786. Acronis security team concluded that Acronis infrastructure and products are not...

Impact of OpenSSL 3.0 Vulnerabilities CVE-2022-3786 and CVE-2022-3602

The OpenSSL Project has published two high severity vulnerabilities CVE-2022-3786 and CVE-2022-3602 that affect OpenSSL versions 3.0.0 through 3.0.6 on November 1st, 2022. The Palo Alto Networks Product Security Assurance team has evaluated and confirmed that all products and services are not...

OpenSSL vulnerabilities: Everything you need to know

On November 1st, 2022, the OpenSSL Project disclosed High severity vulnerabilities CVE-2022-3786 and CVE-2022-3602, affecting deployments of OpenSSL 3.0.0–3.0.6. Learn how to effectively manage your organization's patching efforts...

CVE-2021-3786

creationtimestamp| type| source ---|---|--- 2021-11-13 00:39:15+00:00| seen| https://t.me/cibsecurity/32336...

CVE-2021-3786

CVE-2021-3786 concerns Lenovo notebook/ThinkPad systems with a vulnerable SMI callback in the CSME configuration. The issue is a potential flaw in the SMI callback function that could allow leaking data from the SMRAM range. Public records describe this as a data leakage risk affecting confidenti...

Backdoor.Win32.VB.awm Authentication Bypass / Information Disclosure

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/2271d942a23a89d7adea524d4ac3c13f.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.VB.awm Vulnerability: Authentication Bypass - Information Leakage Description: The...

SUSE: Security Advisory (SUSE-SU-2018:3786-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Adobe Photoshop CC 20.x < 20.0.9 / 21.x < 21.1.1 Multiple Vulnerabilities (macOS APSB20-14)

The version of Adobe Photoshop CC or Photoshop installed on the remote macOS or Mac OS X host is prior to 20.0.9/21.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb20-14 advisory. - Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versio...

Adobe Photoshop CC 20.x < 20.0.9 / 21.x < 21.1.1 Multiple Vulnerabilities (APSB20-14)

The version of Adobe Photoshop CC or Photoshop installed on the remote Windows host is prior to 20.0.9/21.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb20-14 advisory. - Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 an...

CVE-2019-3786

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. Th...

CVE-2019-3786

Cloud Foundry BOSH Backup and Restore CLI (all versions before v1.5.0) does not validate backup-script authenticity in BOSH. A remote authenticated attacker can modify the metadata of a BBR job to request extra backup files from different jobs during restore. The vulnerable hooks are in the cfcr-...

CVE-2019-3786 BBR could run arbitrary scripts on deployment VMs

Cloud Foundry BOSH Backup and Restore CLI, all versions prior to 1.5.0, does not check the authenticity of backup scripts in BOSH. A remote authenticated malicious user can modify the metadata file of a Bosh Backup and Restore job to request extra backup files from different jobs upon restore. Th...

Ubuntu: Security Advisory (USN-3786-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...