Important: Red Hat Security Advisory: gnutls security update

Updated gnutls packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Moderate: Red Hat Security Advisory: libtasn1 security update

Updated libtasn1 packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

MGASA-2014-0247 Updated libtasn1 packages fix CVE-2014-3467-9

Updated libtasn1 packages fix security vulnerabilities: Multiple buffer boundary check issues were discovered in libtasn1 library, causing it to read beyond the boundary of an allocated buffer. An untrusted ASN.1 input could cause an application using the library to crash CVE-2014-3467. It was...

Debian DSA-2922-1 : strongswan - security update

A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE/IPsec suite used to establish IPsec protected links. By sending a crafted IDDERASN1DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a NULL pointer dereference in the daemon parsing th...

[SECURITY] [DSA 2922-1] strongswan security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2922-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez May 05, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2922-1 (strongswan - security update)

A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE/IPsec suite used to establish IPsec protected links. By sending a crafted IDDERASN1DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a null pointer dereference in the daemon parsing th...

DSA-2922-1 strongswan - security update

Bulletin has no description...

Debian: Security Advisory (DSA-2922-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Design/Logic Flaw

Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service abort and daemon exit via ASN.1 data encountered in the Kerberos 5 protocol...

PHP OpenSSL Extension X.509 Certificate Memory Corruption (CVE-2013-6420)

A code execution vulnerability has been reported in PHP. The vulnerability is due to a memory corruption error when handling a malicious ASN.1 data type for a timestamp in an X.509 certificate. A remote attacker can exploit this flaw by sending a malicious certificate...

Amazon Linux AMI : php (ALAS-2013-262)

The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service memory...

[SECURITY] [DSA 2789-1] strongswan security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2789-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez November 01, 2013 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2789-1 (strongswan - Denial of service and authorization bypass)

A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE daemon used to establish IPsec protected links. By sending a crafted IDDERASN1DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a denial of service daemon crash or an authorization...

DSA-2789-1 strongswan - Denial of service and authorization bypass

Bulletin has no description...

Debian: Security Advisory (DSA-2789-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.2 / 11.3 Security Update : wireshark (SAT Patch Numbers 8318 / 8319)

This wireshark version update from 1.8.8 to 1.8.9 includes several security and general bug fixes. bnc831718 http://www.wireshark.org/docs/relnotes/wireshark-1.8.9.html - The Bluetooth SDP dissector could go into a large loop CVE-2013-4927 wnpa-sec-2013-45 - The DIS dissector could go into a larg...

Amazon Linux AMI : nss (ALAS-2012-108)

A flaw was found in the way the ASN.1 Abstract Syntax Notation One decoder in NSS handled zero length items. This flaw could cause the decoder to incorrectly skip or replace certain items with a default value, or could cause an application to crash if, for example, it received a specially crafted...

CVE-2013-5018

The isasn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1length function, which allows remote attackers to cause a denial of service segmentation fault via a 1 XAuth username, 2 EAP identity, or 3 PEM encoded file that starts with a 0x04, 0x30,...

Integer overflow

The isasn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1length function, which allows remote attackers to cause a denial of service segmentation fault via a 1 XAuth username, 2 EAP identity, or 3 PEM encoded file that starts with a 0x04, 0x30,...

CVE-2013-5018

CVE-2013-5018 affects strongSwan (versions 4.1.11–5.0.4) where the is_asn1() function fails to validate the return value of asn1_length, allowing a remote attacker to trigger a denial of service (segmentation fault) via crafted inputs such as an XAuth username, an EAP identity, or a PEM file begi...