Updated kernel-linus package fixes security vulnerabilities

This kernel-linus update is based on upstream -longterm 3.14.39 and fixes the following security issues: It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the uverbs API. A local user with acce...

Updated kernel package fixes security vulnerabilities

This kernel update is based on upstream -longterm 3.14.39 and fixes the following security issues: It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the uverbs API. A local user with access to ...

Debian DLA-36-1 : polarssl security update

Denial of Service against GCM enabled servers and clients. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CloudFlare Deploys ChaCha20-Poly1305 Encryption Across Sites

After rolling out free SSL for its users last fall, CloudFlare has deployed a new level of encryption on its service that hardens and speeds up the user experience, especially when accessing domains via mobile browsers. The form of encryption, a relatively new transport layer cipher suite known a...

OracleVM 3.3 : openssl (OVMSA-2014-0032) (Heartbleed) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SS...

SOL15730 - OpenSSH vulnerability

The mmnewkeysfromblob function in monitorwrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet dat...

IBM 1754 GCM KVM Multiple Vulnerabilities

Exploit for windows platform in category remote exploits Product description The IBM 1754 GCM family provides KVM over IP and serial console management technology in a single appliance. Versions v1.20.0.22575 and prior are vulnerables. Note that this vulnerability is also present in some DELL and...

CVE-2014-3081

prodtest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to read arbitrary files via the filename parameter...

openSUSE Security Update : apache2-mod_nss (openSUSE-SU-2014:0979-1)

apache2-modnss is alternative yet not exclusive to modnss. This update introduces Server Name Indication support to modnss, which was not available previously. In addition to SNI, GCM ciphers have been added to the cipher list of modnss. A bug was corrected that prevented the entry of the...

[DLA 36-1] polarssl security update

Package : polarssl Version : 1.2.9-1deb6u2 CVE ID : CVE-2014-4911 Debian Bug : 754655 Denial of Service against GCM enabled servers and clients...

DLA-36-1 polarssl - security update

Bulletin has no description...

MGASA-2014-0315 Updated polarssl packages fix security vulnerability

A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute...

Updated polarssl packages fix security vulnerability

A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute...

CVE-2014-4911

The ssldecryptbuf function in library/ssltls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service crash via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit...

Design/Logic Flaw

The ssldecryptbuf function in library/ssltls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service crash via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit...

CVE-2014-4911

The ssldecryptbuf function in library/ssltls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service crash via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit...

CVE-2014-4911

CVE-2014-4911 affectsPolarSSL: the ssl_decrypt_buf function in ssl_tls.c is vulnerable in 1.2.x before 1.2.11 and in 1.3.x before 1.3.8, allowing remote DoS (crash) via GCM cipher suites (as demonstrated with Defensics). Mitigation is upgrading to PolarSSL 1.2.11 or 1.3.8+ (or newer) where the is...

CVE-2014-4911

The ssldecryptbuf function in library/ssltls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service crash via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit...

PolarSSL DoS

DoS on GCM cypher...

IBM GCM16/32 1.20.0.22575 - Multiple Vulnerabilities

Exploit for php platform in category web applications Product description The IBM 1754 GCM family provides KVM over IP and serial console management technology in a single appliance. Versions v1.20.0.22575 and prior are vulnerables. Note that this vulnerability is also present in some DELL and...