FreeBSD : gnutls -- denial of service (9065b930-3d8b-11e3-bd1a-e840f2096bd0)

Salvatore Bonaccorso reports : This vulnerability affects the DANE library of gnutls 3.1.x and gnutls 3.2.x. A server that returns more 4 DANE entries could corrupt the memory of a requesting client. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

gnutls -- denial of service

Salvatore Bonaccorso reports: This vulnerability affects the DANE library of gnutls 3.1.x and gnutls 3.2.x. A server that returns more 4 DANE entries could corrupt the memory of a requesting client...

[slackware-security] gnutls

New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/gnutls-2.10.5-i486-2slack13.37.txz: Rebuilt. Updated to the correct version to fix fetching the "latest" from gnu.org...

Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 : gnutls (SSA:2013-287-03)

New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-287-03. The text itself is...

Amazon Linux AMI : gnutls (ALAS-2013-197)

It was discovered that the fix for the CVE-2013-1619 issue introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. CVE-2013-2116 C...

Amazon Linux AMI : libtasn1 (ALAS-2012-60)

A flaw was found in the way libtasn1 decoded DER data. An attacker could create carefully-crafted DER encoded input such as an X.509 certificate that, when parsed by an application that uses libtasn1 such as applications using GnuTLS, could cause the application to crash. CVE-2012-1569 C Tenable...

Amazon Linux AMI : gnutls (ALAS-2013-172)

It was discovered that GnuTLS leaked timing information when decrypting TLS/SSL protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL server as a padding oracle...

Amazon Linux AMI : gnutls (ALAS-2012-59)

A flaw was found in the way GnuTLS decrypted malformed TLS records. This could cause a TLS/SSL client or server to crash when processing a specially crafted TLS record from a remote TLS/SSL connection peer. CVE-2012-1573 A boundary error was found in the gnutlssessiongetdata function. A malicious...

Slackware 14.0 / current : gnutls (SSA:2013-242-01)

New gnutls packages are available for Slackware 14.0, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-242-01. The text itself is copyright C...

Slackware 14.0 / current : gnutls (SSA:2013-242-03)

New gnutls packages are available for Slackware 14.0 and -current to fix a security issue. Sorry about having to reissue this one -- I pulled it from ftp.gnu.org not realizing that the latest version there was actually months out of date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

[slackware-security] gnutls

New gnutls packages are available for Slackware 14.0 and -current to fix a security issue. Sorry about having to reissue this one -- I pulled it from ftp.gnu.org not realizing that the latest version there was actually months out of date. Here are the details from the Slackware 14.0 ChangeLog:...

[slackware-security] gnutls

New gnutls packages are available for Slackware 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/gnutls-3.0.26-i486-1slack14.0.txz: Upgraded. This update prevents a side-channel attack which may allow remote attackers to conduct...

GnuTLS TLS Record Decoding Out-of-bounds Memory Access (CVE-2013-2116)

An out-of-bounds memory access vulnerability has been found in GnuTLS...

VMSA-2013-0009 VMware ESX and ESXi updates to third party libraries

VMware has updated several third party libraries in ESX and ESXi to address multiple security vulnerabilities. OpenVAS Vulnerability Test $Id: gbVMSA-2013-0009.nasl 6074 2017-05-05 09:03:14Z teissa $ VMSA-2013-0009 VMware ESX and ESXi updates to third party libraries Authors: Michael Meyer...

VMSA-2013-0009 : VMware vSphere, ESX and ESXi updates to third-party libraries

a. vCenter Server and ESX userworld update for OpenSSL library The userworld OpenSSL library is updated to version openssl-0.9.8y to resolve multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2013-0169 and CVE-2013-0166 to these...

Important: Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update

An updated rhev-hypervisor6 package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Oracle Linux 5 / 6 : gnutls (ELSA-2013-0588)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0588 advisory. 2.8.5-10.1 - fix CVE-2013-1619 - fix TLS-CBC timing attack 908238 Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 5 : gnutls (ELSA-2012-0428)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0428 advisory. - fix CVE-2011-4128 - buffer overflow in gnutlssessiongetdata 752308 - fix CVE-2012-1569 - missing length check when decoding DER lengths 804920 Tenabl...

Oracle Linux 5 : gnutls (ELSA-2010-0166)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0166 advisory. - implement safe renegotiation - CVE-2009-3555 533125 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Oracle Linux 6 : gnutls (ELSA-2012-0429)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0429 advisory. - fix CVE-2012-1573 - security issue in packet parsing 805432 Tenable has extracted the preceding description block directly from the Oracle Linux...