Debian DLA-247-1 : openssl security update (Logjam)

Multiple vulnerabilities were discovered in OpenSSL, a Secure Sockets Layer toolkit. CVE-2014-8176 Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that an invalid memory free could be triggered when buffering DTLS data. This could allow remote attackers to cause a denial of...

UBUNTU-CVE-2015-1789

The X509cmptime function in crypto/x509/x509vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted length field in ASN1TIME data, as demonstrated...

GNU Libtasn1 'decoding.c' Heap Buffer Overflow Vulnerability

GNU Libtasn1 is a stand-alone library written in C for manipulating ASN.1 objects that include DER/BER encoding and decoding. A heap buffer overflow vulnerability exists in the asn1extractderoctet function of GNU Libtasn1 lib/decoding.c. A remote attacker could cause a denial of service by...

libtasn1 stack buffer overflow vulnerability

Libtasn1 is a C library from the GNU project for developing ASN.1 Abstract Syntax Notation One, a standard for describing the representation, encoding, transmission, and decoding of data structure management. A stack buffer overflow vulnerability exists in the asn1derdecoding function in versions...

DEBIAN-CVE-2015-2806

Stack-based buffer overflow in asn1derdecoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors...

PT-2015-1318

Name of the Vulnerable Software and Affected Versions libtasn1 versions prior to 4.4 Description The issue is related to a stack-based buffer overflow in the asn1 der decoding function, which can be exploited by remote attackers through unknown vectors, potentially leading to disruption of...

UBUNTU-CVE-2015-2806

Stack-based buffer overflow in asn1derdecoding in libtasn1 before 4.4 allows remote attackers to have unspecified impact via unknown vectors...

openssl: invalid pointer use in ASN1_TYPE_cmp()

An invalid pointer use flaw was found in OpenSSL's ASN1TYPEcmp function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application...

Debian DLA-77-1 : libtasn1-3 security update

Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 Abstract Syntax Notation One structures. An attacker could use those to cause a denial of service via out-of-bounds access or NULL pointer dereference. NOTE: Tenable Network Security has extracted the preceding...

openssl: invalid pointer use in ASN1_TYPE_cmp()

An invalid pointer use flaw was found in OpenSSL's ASN1TYPEcmp function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application...

openssl: ASN.1 structure reuse memory corruption

An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could possibly use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash...

openssl: invalid pointer use in ASN1_TYPE_cmp()

An invalid pointer use flaw was found in OpenSSL's ASN1TYPEcmp function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application...

OpenSSL 'ASN1_TYPE_cmp' Function Denial of Service Vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A denial of service vulnerability exists in the 'ASN1TYPEcmp' function of OpenSSL 'crypto/asn1/atype.c'. Due to the program failing t...

DEBIAN-CVE-2015-0289

The PKCS7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service NULL pointer dereference and application crash by leveraging an applicati...

DEBIAN-CVE-2015-0287

The ASN1itemexd2i function in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service invalid write operation and memory...

DEBIAN-CVE-2015-0286

The ASN1TYPEcmp function in crypto/asn1/atype.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service invalid read operation and application crash...

CVE-2015-0286: Undefined Security Weakness

The ASN1TYPEcmp function in crypto/asn1/atype.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service invalid read operation and application crash...

CVE-2015-0287

OpenSSL vulnerability CVE-2015-0287 is present when ASN.1 structures are reused without proper reinitialization, causing a memory write error and memory corruption that can lead to a denial of service. Affected OpenSSL versions include those before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1...

DSA-3197-1 openssl - security update

Bulletin has no description...

CVE-2015-0287

The ASN1itemexd2i function in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service invalid write operation and memory...