CVE-2014-3470

The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...

USN-2232-1: OpenSSL vulnerabilities

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS...

openssl: client-side denial of service when using anonymous ECDH

The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...

CVE-2014-3470

The ssl3sendclientkeyexchange function in s3clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service NULL pointer dereference and client crash by triggering a NULL certificate...

[SECURITY] [DSA 2950-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2950-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 05, 2014 http://www.debian.org/security/faq -...

OpenSSL Vulnerable to Man-in-the-Middle Attack and Several Other Bugs

Remember OpenSSL Heartbleed vulnerability? Several weeks ago, the exposure of this security bug chilled the Internet, revealed that millions of websites were vulnerable to a flaw in the OpenSSL code which they used to encrypt their communications. Now once again the OpenSSL Foundation has issued...

openssl security update

1.0.1e-16.14 - fix CVE-2010-5298 - possible use of memory after free - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment - fix CVE-2014-0198 - possible NULL pointer dereference - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet - fix CVE-2014-0224 - SSL/TLS MITM vulnerabilit...

DSA-2950-1 openssl - security update

Bulletin has no description...

Debian Security Advisory DSA 2950-1 (openssl - security update)

Multiple vulnerabilities have been discovered in OpenSSL: CVE-2014-0195 Jueri Aedla discovered that a buffer overflow in processing DTLS fragments could lead to the execution of arbitrary code or denial of service. CVE-2014-0221 Imre Rad discovered the processing of DTLS hello packets is...

Vulnerability in OpenSSL - Anonymous ECDH denial of service

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. Found by Felix Gröbert and Ivan Fratrić Google...

Fedora 19 : gnutls-3.1.15-1.fc19 (2013-20052)

New minor upstream release fixing a security issue. Adds ECC NIST Suite B curves support ECDH, ECDSA Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as...

OpenSSL Handshake Requests ECDH Use-After-Free (CVE-2011-3210)

A use-after-free vulnerability has been reported in OpenSSL...

Ubuntu Update for openssl USN-1357-1

Ubuntu Update for Linux kernel vulnerabilities USN-1357-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13571.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for openssl USN-1357-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu: Security Advisory (USN-1357-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication flaw

crypto/bn/bnnist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows...

CVE-2011-4354

OpenSSL vulnerability CVE-2011-4354 affects OpenSSL before 0.9.8h on 32-bit platforms, in the ECDH/ECDHE handshake with P-256 and P-384 curves, due to an incorrect modular reduction algorithm in bn_nist.c. This design flaw allows remote attackers to obtain the TLS server private key after multipl...

CVE-2011-4354

crypto/bn/bnnist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows...

OpenSSL < 0.9.8p / 1.0.0e Double Free Vulnerability

According to its banner, the remote server is running a version of OpenSSL that is earlier than 0.9.8p / 1.0.0e. A remote attacker could crash client software when using ECDH. The impact of this vulnerability is not clear; arbitrary code could be run too. Note that OpenSSL changelog only reports ...

SuSE 11.1 Security Update : libopenssl (SAT Patch Number 5160)

Server code for ECDH could have crashed if it received a specially crafted handshake message CVE-2011-3210. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 7766)

Server code for ECDH could have crashed if it received a specially crafted handshake message CVE-2011-3210. This has been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...