F5 BIG-IP - OpenSSL vulnerability CVE-2015-0209

The remote host is missing a security patch. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

openSUSE Security Update : apache2 (openSUSE-2015-635) (Logjam)

Apache2 was updated to fix security issues. - CVE-2015-3185: The apsomeauthrequired function in server/request.c in the Apache HTTP Server 2.4.x did not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection...

Multiple EMC RSA products vulnerable

EMC RSA BSAFE is a security software product. A security vulnerability exists in multiple EMC RSA products that can be exploited by a remote attacker to perform an SSL handshake using an ECDH ciphersuite that omits the server key exchange message, compromising the forward secrecy of the ciphersui...

The vulnerability of the BN_GF2m_mod_inv function in the OpenSSL library, which allows a hacker to cause a service failure.

The vulnerability of the BNGF2mmodinv function crypto/bn/bngf2m.c in the OpenSSL library is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions due to errors occurring during the establishment of a connection session. Thi...

OpenSSL Elliptic Curve Binary Polynomial Field Resource Exhaustion (CVE-2015-1788)

A denial of service vulnerability has been reported in OpenSSL. The vulnerability is due to a missing validity check of Elliptic Curve parameters within BNGF2mmodinv. A remote attacker can exploit this vulnerability by sending a crafted certificate to a vulnerable OpenSSL client or server...

Scientific Linux Security Update : wireshark on SL6.x i386/x86_64 (20150722)

Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. CVE-2014-8714, CVE-2014-8712, CVE-2014-8713, CVE-2014-8711, CVE-2014-8710, CVE-2015-0562, CVE-2015-0564, CVE-2015-2189,...

wireshark security, bug fix, and enhancement update

1.8.10-17.0.2 - Fix ocfs2 dissector John Haxby orabug 21505640 1.8.10-17.0.1.el6 - Add oracle-ocfs2-network.patch to allow disassembly of OCFS2 interconnect 1.8.10-17 - security patches - Resolves: CVE-2015-2189 CVE-2015-2191 1.8.10-16 - security patches - Resolves: CVE-2014-8710 CVE-2014-8711...

wireshark security update

CentOS Errata and Security Advisory CESA-2015:1460 Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common...

JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833)

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE...

RHEL 6 : wireshark (RHSA-2015:1460)

Updated wireshark packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which...

RedHat Update for wireshark RHSA-2015:1460-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833)

Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE...

Mozilla Firefox NSS Spoofing Vulnerability

Mozilla Firefox is a web browser released by Mozilla. A spoofing vulnerability exists in Mozilla Firefox NSS, which can be exploited by remote attackers to spoof ECDSA signatures because NSS fails to properly perform ECC multiplication...

DEBIAN-CVE-2015-2730

Mozilla Network Security Services NSS before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography ECC multiplications, which makes it easier for remote attackers to spoof ECDS...

UBUNTU-CVE-2015-2730

Mozilla Network Security Services NSS before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography ECC multiplications, which makes it easier for remote attackers to spoof ECDS...

OpenSSL BN_GF2m_mod_inv Function Denial of Service Vulnerability

OpenSSL is an open source implementation of SSL used to enable strong encryption of network communications and is now widely used in a variety of web applications. A security vulnerability exists in the 'BNGF2mmodinv' function in the crypto/bn/bngf2m.c file of OpenSSL due to the program failing t...

CVE-2015-1788

The BNGF2mmodinv function in crypto/bn/bngf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a...