CVE-2018-11058

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 in 4.0.x contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data th...

CVE-2018-11058

RSA BSAFE Micro Edition Suite, versions prior to 4.0.11 in 4.0.x and prior to 4.1.6 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition, version prior to 4.0.5.3 in 4.0.x contain a Buffer Over-Read vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 data th...

CVE-2018-11058

CVE-2018-11058 affects RSA BSAFE Micro Edition Suite (4.0.x before 4.0.11; 4.1.x before 4.1.6) and RSA BSAFE Crypto-C Micro Edition (4.0.x before 4.0.5.3). The issue is a buffer over-read when parsing ASN.1 data, exploitable by remotely crafted ASN.1 input. Connected Nessus entries (e.g., Oracle ...

openSUSE Security Update : compat-openssl098 (openSUSE-2018-997)

This update for compat-openssl098 fixes the following security issues : - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of...

Security update for compat-openssl098 (moderate)

This update for compat-openssl098 fixes the following security issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of...

Integer overflow

RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service...

Design/Logic Flaw

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 in 4.0.x contain an Uncontrolled Resource Consumption 'Resource Exhaustion' vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 dat...

CVE-2018-11054

RSA BSAFE Micro Edition Suite, version 4.1.6, contains an integer overflow vulnerability. A remote attacker could use maliciously constructed ASN.1 data to potentially cause a Denial Of Service...

CVE-2018-11056

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 in 4.0.x contain an Uncontrolled Resource Consumption 'Resource Exhaustion' vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 dat...

CVE-2018-11056

RSA BSAFE Micro Edition Suite, prior to 4.1.6.1 in 4.1.x, and RSA BSAFE Crypto-C Micro Edition versions prior to 4.0.5.3 in 4.0.x contain an Uncontrolled Resource Consumption 'Resource Exhaustion' vulnerability when parsing ASN.1 data. A remote attacker could use maliciously constructed ASN.1 dat...

Amazon Linux AMI : openssl (ALAS-2018-1065)

Because of an implementation bug the PA-RISC CRYPTOmemcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security...

Updated libtomcrypt packages fix security vulnerability

libtomcrypt has been updated to secure it against two security vulnerabilities. A problem in the ASN.1 parser could cause a stack overflow and a resulting denial of service when parsing deeply recursive ASN.1 types CVE-2018-0739. An attacker capable of triggering signatures and mounting a side...

Denial Of Service (DoS) Through Out-of-Bounds Read

libtasn1.so is vulnerable to denial of service DoS attacks. The library contains multiple missing boundary checks, allowing a malicious user to pass ASN.1 input to cause an out-of-bounds read that can crash the application...

Security update for wireshark (moderate)

This update for wireshark fixes the following issues: Security issues fixed: - CVE-2018-14342: BGP dissector large loop wnpa-sec-2018-34, boo1101777 - CVE-2018-14344: ISMP dissector crash wnpa-sec-2018-35, boo1101788 - CVE-2018-14340: Multiple dissectors could crash wnpa-sec-2018-36, boo1101804 -...

SUSE-SU-2018:2158-1 Security update for ovmf

This update for ovmf provide the following fix: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth bsc1094290, bsc1094291. Bug fixes: - Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better...

Oracle Secure Global Desktop Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle Secure Global Desktop installed on the remote host is 5.3 / 5.4 and is missing a security patch from the July 2018 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities: - curl version curl 7.54.1 to and including curl 7.59.0 contains a Heap-based...

Updated wireshark packages fix security vulnerabilities

RPKI-Router infinite loop CVE-2018-7325. MMSE dissector infinite loop CVE-2018-14339. Multiple dissectors could crash CVE-2018-14340. DICOM dissector crash CVE-2018-14341. BGP dissector large loop CVE-2018-14342. ASN.1 BER dissector crash CVE-2018-14343. ISMP dissector crash CVE-2018-14344. Bazaa...

CVE-2018-14343

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer...

Wireshark Security Updates (wnpa-sec-2018-34_wnpa-sec-2018-41) - Mac OS X

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

CVE-2018-14343

In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the ASN.1 BER dissector could crash. This was addressed in epan/dissectors/packet-ber.c by ensuring that length values do not exceed the maximum signed integer...