2606 matches found
Design/Logic Flaw
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
Security update for MozillaFirefox, mozilla-nss (important)
Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included: - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...
CVE-2016-5258
CVE-2016-5258 is a use-after-free vulnerability in Firefox’s WebRTC DTLS handling, specifically a memory misreference in the WebRTC socket thread during shutdown of a WebRTC session. Public sources consistently describe it as allowing remote code execution due to incorrect free operations on DTLS...
CVE-2016-5258
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
CVE-2016-5258
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
CVE-2016-5258: Use After Free
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
CVE-2016-5258
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
UBUNTU-CVE-2016-5258
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session...
Use-after-free in DTLS during WebRTC session shutdown — Mozilla
Security researcher Looben Yang reported a use-after-free vulnerability in WebRTC. This occurs during WebRTC session shutdown when DTLS objects in memory are freed while still actively in use. This results in a potentially exploitable crash...
The vulnerability of Cisco ASA software allows a malicious individual to execute arbitrary code.
The vulnerability exists in the function dtls1reassemblefragment in d1both.c in OpenSSL, due to incorrect checking of the length of fragments in DTLS ClientHello messages. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure buffer overflow and...
The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality and accessibility of protected information.
A memory leak in the d1srtp.c file of the DTLS SRTP extension in OpenSSL allows malicious actors operating remotely to trigger a service failure excessive memory consumption through specially crafted negotiation messages...
OracleVM 3.2 : openssl (OVMSA-2016-0086)
The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2016-0799 - Fix memory issues in BIOprintf functions - CVE-2016-2105 - Avoid overflow in EVPEncodeUpdate - CVE-2016-2106 - Fix encrypt overflow - CVE-2016-2109 - Harden ASN.1 BIO handling of large...
[SECURITY] Fedora 24 Update: gnutls-3.4.13-1.fc24
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...
[SECURITY] Fedora 23 Update: gnutls-3.4.13-1.fc23
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...
CVE-2016-2107
It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when the connection used the AES CBC cipher suite and the server supported AES-NI. A remote attacker could possibly use this flaw to retrieve plain text from encrypted packets by...
Analyzing TLS Libraries: TLS-Attacker
TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS protocol flow...
Cisco IOS Multiple OpenSSL Vulnerabilities (CSCup22590)
The remote Cisco IOS device is missing a vendor-supplied security patch and has an IOS service configured to use TLS or SSL. It is, therefore, affected by the following vulnerabilities in the bundled OpenSSL library : - A buffer overflow error exists related to invalid DTLS fragment handling that...
CVE-2015-6925
wolfSSL formerly CyaSSL before 3.6.8 allows remote attackers to cause a denial of service resource consumption or traffic amplification via a crafted DTLS cookie in a ClientHello message...
CVE-2015-6925
wolfSSL formerly CyaSSL before 3.6.8 allows remote attackers to cause a denial of service resource consumption or traffic amplification via a crafted DTLS cookie in a ClientHello message...
DEBIAN-CVE-2015-6925
wolfSSL formerly CyaSSL before 3.6.8 allows remote attackers to cause a denial of service resource consumption or traffic amplification via a crafted DTLS cookie in a ClientHello message...