Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM PureApplication System.

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM PureApplication System. IBM PureApplication System has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6302 DESCRIPTION: OpenSSL is vulnerable to a denia...

CVE-2018-6304

CVE-2018-6304 affects Gemalto Sentinel LDK RTE. A stack overflow in the custom XML-parser (in Sentinel LDK RTE) prior to version 7.65 is described as the root cause, with remote denial of service as theImpact. Public sources in the connected documents confirm the component and version range vulne...

Debian: Security Advisory (DLA-878-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 / 7 : Red Hat JBoss Web Server 2 (RHSA-2017:2493)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2493 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update

An update is now available for Red Hat JBoss Web Server 2.1.2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

RHEL 6 / 7 : JBoss EAP (RHSA-2017:1658)

An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update

An update is now available for Red Hat JBoss Enterprise Application Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6

An update is now available for Red Hat JBoss Core Services on RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Debian DLA-878-1 : libytnef security update

CVE-2017-6298 NULL pointer Deref / calloc return value not checked CVE-2017-6299 Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c CVE-2017-6300 Buffer Overflow in version field in lib/tnef-types.h CVE-2017-6301 Out of Bounds Reads CVE-2017-6302 Integer Overflow CVE-2017-6303 Invali...

Internet Bug Bounty: OCSP Status Request extension unbounded memory growth (CVE-2016-6304)

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service...

CVE-2017-6304

An issue was discovered in ytnef before 1.9.1. This is related to a patch described as "7 of 9. Out of Bounds read."...

CVE-2017-6304

Consolidated details show CVE-2017-6304 affects ytnef/libytnef prior to 1.9.1. The root cause is an out-of-bounds read/write issue in decoding TNEF data (noted as patch 7 of 9), leading to potential crashes/DoS. OpenVAS/Fedora/Ubuntu advisories mention multiple related CVEs in libytnef with heap/...

Mac OS X Multiple Vulnerabilities (Security Updates 2016-003 / 2016-007)

The remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the sslparseclienthellotlsext function within file ssl/t1lib.c when handling oversize OCSP...

Fedora Update for openssl FEDORA-2016-64e0743e16

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : openssl (RHSA-2016:2802)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2802 advisory. - openssl: OCSP Status Request extension unbounded memory growth CVE-2016-6304 Note that Nessus has not tested for this issue but has instead relied...

openSUSE: Security Advisory for mysql-community-server (openSUSE-SU-2016:2769-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

F5 BIG-IP - OpenSSL vulnerability CVE-2016-6304

Multiple memory leaks in t1lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service memory consumption via large OCSP Status Request extensions. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...

Amazon Linux: Security Advisory (ALAS-2016-749)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA10888 Multiple vulnerabilities in Oracle VM VirtualBox

Multiple serious vulnerabilities have been found in Oracle VM VirtualBox. Malicious users can exploit these vulnerabilities to cause denial of service, affect integrity or obtain sensitive information. These vulnerabilities can be executed remotely and related to Core, OpenSSL and VRDE. Original...

Oracle MySQL Server 5.6 <= 5.6.33 / 5.7 <= 5.7.15 Security Update (cpuoct2016) - Linux

Oracle MySQL Server is prone to an unspecified vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...