SSL Vulnerability Affects OSX Too

The certificate-validation vulnerability that Apple patched in iOS yesterday also affected Mac OS X up to 10.9.1, the current version. Several security researchers analyzed the patch and looked at the code in question in OS X and found that the same error exists there as in iOS. Researcher Adam...

Google Chrome < 33.0.1750.117 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.117. It is, therefore, affected by the following vulnerabilities : - Use-after-free errors exist related to handling web components and layout. CVE-2013-6653, CVE-2013-6655, CVE-2013-6658 - A castin...

OpenSSL: Denial of service

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description A flaw in the ssl3takemac function can result in a NULL pointer dereference. Impact A remote attacker cou...

Google Chrome < 33.0.1750.117 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.117. It is, therefore, affected by the following vulnerabilities : - An error exists related to relative path in Windows sandbox named pipe policy. CVE-2013-6652 - Use-after-free errors exist related to...

Google Fixes 28 Security Flaws in Chrome 33

Google Chrome 33 is out, and the new version of the browser includes fixes for 28 security vulnerabilities, including a number of high-severity bugs. The company paid out more than $13,000 in rewards to researchers who reported vulnerabilities that were fixed in this release. One of the...

CVE-2014-0625

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0627

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

Design/Logic Flaw

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

CVE-2014-0625

The CVE-2014-0625 issue affects RSA BSAFE SSL-J (JSAFE/JSSE) 5.x before 5.1.3 and 6.x before 6.0.2, where SSLSocket processing during TLS handshakes can buffer application data, leading to memory-based DoS. The SUSE/Security advisory and ESA-2014-009 describe a memory-denial vulnerability in the ...

CVE-2014-0627

Summary: CVE-2014-0627 affects EMC RSA BSAFE SSL-J (SSL-J) 5.x before 5.1.3 and 6.x before 6.0.2. The SSLEngine API can reveal information by using the wrap method after the Finished message in an incomplete handshake, potentially allowing an attacker to trigger a weak cipher suite. Impact: Infor...

CVE-2014-0626: Undefined Security Weakness

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

CVE-2014-0625: Undefined Security Weakness

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626

The RSA BSAFE SSL-J vulnerability CVE-2014-0626 affects SSL-J 5.x (before 5.1.3) and 6.x (before 6.0.2). The JSAFE and JSSE APIs can process application data during the TLS handshake, exposing data unencrypted and unauthenticated and enabling potential information disclosure at handshake time. Ac...

CVE-2014-0625

The SSLSocket implementation in the 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to cause a denial of service memory consumption by triggering application-data processing during the TLS handshake, a time at which the data is internal...

CVE-2014-0626

The 1 JSAFE and 2 JSSE APIs in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 make it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data processing during the TLS handshake, a time at which the data is both unencrypted and...

PT-2014-3722

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue makes it easier for remote attackers to bypass intended cryptographic protection mechanisms by triggering application-data...

CVE-2014-0627: Undefined Security Weakness

The SSLEngine API implementation in EMC RSA BSAFE SSL-J 5.x before 5.1.3 and 6.x before 6.0.2 allows remote attackers to trigger the selection of a weak cipher suite by using the wrap method during a certain incomplete-handshake state...

PT-2014-3721

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE SSL-J versions 5.x before 5.1.3 EMC RSA BSAFE SSL-J versions 6.x before 6.0.2 Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by triggering application-data processing...

PT-2014-1283

Name of the Vulnerable Software and Affected Versions Dovecot versions 1.1 through 2.2.12 Dovecot-ee versions 2.1.7.7 and earlier Dovecot-ee versions 2.2.x through 2.2.12.12 Description The issue is related to the improper closure of old connections, which can be exploited by a remote attacker to...