CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

PT-2016-2766

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.1.0 Description The issue is related to the Anti-Replay feature in the DTLS implementation, which mishandles early use of a new epoch number in conjunction with a large sequence number. This allows remote attackers ...

PT-2016-3417

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.1.0 Description The issue is related to the DTLS implementation in OpenSSL, which does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers t...

UBUNTU-CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service false-positive packet drops via spoofed DTLS records, related to reclayerd1...

CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service false-positive packet drops via spoofed DTLS records, related to reclayerd1...

CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

CVE-2016-2179: Undefined Security Weakness

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

CVE-2016-2179

OpenSSL CVE-2016-2179: The DTLS implementation could exhaust memory by accepting many crafted DTLS sessions due to unprocessed, out-of-order handshake messages. This memory-DoS vectors arises from DTLS queue handling in d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. Public advisories (...

CVE-2016-2181

OpenSSL CVE-2016-2181 affects the Datagram TLS (DTLS) replay protection: a flaw in the replay window handling could cause legitimate packets to be dropped when a crafted sequence number is used, enabling a remote attacker to cause DoS. Upstream fixes were released (e.g., OpenSSL 1.0.2.x and 1.0.1...

CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service false-positive packet drops via spoofed DTLS records, related to reclayerd1...

CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service memory consumption by maintaining many crafted DTLS sessions simultaneously, related to...

CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service false-positive packet drops via spoofed DTLS records, related to reclayerd1...

[SECURITY] Fedora 25 Update: gnutls-3.5.4-1.fc25

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2016:2195-1)

Mozilla Firefox was updated to 45.3.0 ESR to fix the following issues bsc991809 : - MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards rv:48.0 / rv:45.3 - MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed - MFSA 2016-64/CVE-2016-2838...

Mozilla Firefox ESR < 45.3 Multiple Vulnerabilities

Binary data 9485.prm...

CVE-2016-2181

A flaw was found in the Datagram TLS DTLS replay protection implementation in OpenSSL. A remote attacker could possibly use this flaw to make a DTLS server using OpenSSL to reject further packets sent from a DTLS client over an established DTLS connection...

Vulnerability in OpenSSL - DTLS buffered message DoS

In a DTLS connection where handshake messages are delivered out-of-order those messages that OpenSSL is not yet ready to process will be buffered for later use. Under certain circumstances, a flaw in the logic means that those messages do not get removed from the buffer even though the handshake...

Vulnerability in OpenSSL - DTLS replay protection DoS

A flaw in the DTLS replay attack protection mechanism means that records that arrive for future epochs update the replay protection “window” before the MAC for the record has been validated. This could be exploited by an attacker by sending a record for the next epoch which does not have to decry...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code

The vulnerability of WebRTC sockets in Firefox and Firefox ESR browsers relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using incorrect free operations on DTLS objects during the termination of a WebRTC session...