Oracle Linux 8 : java-11-openjdk (ELSA-2023-0200)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0200 advisory. 1:11.0.18.0.10-1 - Update to jdk-11.0.18+10 GA - Update release notes to 11.0.18+10 - Switch to GA mode for release - This tarball is embargoed until...

RHEL 8 : java-11-openjdk (RHSA-2023:0200)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0200 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

RHEL 9 : java-11-openjdk (RHSA-2023:0202)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0202 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

ALSA-2023:0202 Moderate: java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixes: OpenJDK: handshake DoS attack against DTLS connections JSSE, 8287411 CVE-2023-21835 OpenJDK: soundbank URL remote loading Sound, 8293742 CVE-2023-21843 Fo...

CVE-2023-21835

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

CVE-2023-21835

CVE-2023-21835 affects Oracle Java SE and GraalVM Enterprise Edition (JSSE/DTLS handshake). An unauthenticated network attacker can exploit DTLS to cause a partial denial of service on affected Java runtimes. Affected: Oracle Java SE 11.0.17, 17.0.5, 19.0.1 and Oracle GraalVM EE 20.3.8, 21.3.4, 2...

CVE-2023-21835

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

CVE-2023-21835

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

PT-2023-1249

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.17, 17.0.5, 19.0.1 Oracle GraalVM Enterprise Edition versions 20.3.8, 21.3.4, 22.3.0 Description The issue is related to an easily exploitable vulnerability in the JSSE component of Oracle Java SE and Oracle GraalV...

CVE-2023-21835: Undefined Security Weakness

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

Fedora 36 : mbedtls (2023-3c4a525dcc)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3c4a525dcc advisory. - Update to 2.28.2 Release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.2 Tenable has extracted the preceding description block...

openSUSE 15 Security Update : mbedtls (openSUSE-SU-2022:10257-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10257-1 advisory. - An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer...

OPENSUSE-SU-2022:10257-1 Security update for mbedtls

This update for mbedtls fixes the following issues: - CVE-2022-46393: Fixed potential heap buffer overread and overwrite in DTLS boo1206576...

openSUSE 15 Security Update : mbedtls (openSUSE-SU-2022:10247-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10247-1 advisory. - An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an...

OPENSUSE-SU-2022:10247-1 Security update for mbedtls

This update for mbedtls fixes the following issues: - CVE-2022-35409: Fixed buffer overread in DTLS ClientHello parsing boo1201581...

PT-2022-37626

Name of the Vulnerable Software and Affected Versions mbedtls affected versions not specified Description The issue is related to a buffer overread in DTLS ClientHello parsing. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

Cisco Firepower Threat Defense Software SSL/TLS DoS (cisco-sa-asaftd-sslvpndma-dos-HRrqB9Yx)

A vulnerability in the SSL VPN negotiation process for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to inefficient direct memory access...

Heap overflow

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLSSSLDTLSCONNECTIONID is enabled and MBEDTLSSSLCIDINLENMAX 2 MBEDTLSSSLCIDOUTLENMAX...

CVE-2022-46393

An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS if MBEDTLSSSLDTLSCONNECTIONID is enabled and MBEDTLSSSLCIDINLENMAX 2 MBEDTLSSSLCIDOUTLENMAX...

Mbed TLS 缓冲区错误漏洞

Mbed TLS is an open source, portable, easy-to-use, readable and flexible SSL library. A security vulnerability exists in Mbed TLS versions prior to 2.28.2 and Mbed TLS versions prior to 3.3.0, which stems from a potential heap-based buffer overflow and heap-based buffer overflow in DTLS if...