PT-2018-2601 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.20.2 Description: The issue is related to the implementation of the update blocked averages function in the Linux kernel, which can lead to an infinite loop due to an unreachable exit condition. This can be...

DEBIAN-CVE-2014-2903

CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...

CVE-2014-2903

CVE-2014-2903 affects CyaSSL (WolfSSL) and related builds; the root cause is that key usage extension checking in leaf certificates is not performed, allowing a remote attacker to spoof a server with a certificate not authorized for SSL/TLS handshakes. The connected records corroborate the issue ...

CVE-2017-9647

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015...

CVE-2017-9633

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 PMB 8876 chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti...

CVE-2017-9633

The CVE-2017-9633 entry documents a TMSI-related vulnerability in Continental AG Infineon S-Gold 2 (PMB 8876) used in telematics control units (TCUs) across multiple vehicles (BMW, Ford, Infiniti, Nissan models from 2009–2016). The issue is an Improper Restriction of Operations within the Bounds ...

Hostname verification skipped when custom root certs used

If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check...

Chain Certificate Forgery

OpenSSL is vulnerable to chain certificate forgery. A malicious user can bypass the certificate verification process, enabling the user to use a valid leaf certificate and "issue" an invalid certificate...

CVE-2016-6457

A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure ACI could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on the affected device. This vulnerability affects Cisco Nexus 9000 Series Leaf Switches TO...

CVE-2016-6457

A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure ACI could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on the affected device. This vulnerability affects Cisco Nexus 9000 Series Leaf Switches TO...

CVE-2016-6457

A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure ACI could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on the affected device. This vulnerability affects Cisco Nexus 9000 Series Leaf Switches TO...

UBUNTU-CVE-2016-7914

The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service invalid pointer dereference and out-of-bounds read v...

kernel: assoc_array: don't call compare_object() on a node

The assocarrayinsertintoterminalnode function in 'lib/assocarray.c' in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service invalid pointer dereference and out-of-bounds read...

Cisco Application Policy Infrastructure Controller Denial of Service Vulnerability (cisco-sa-20161102-n9kapic)

A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure ACI could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on the affected device. Copyright C 2016 Greenbone Networks GmbH Some text descriptions mig...

Nissan Nissan Leaf electric car, and vulnerability-exposure-vulnerability warning-the black bar safety net

Recently, a famous security researcher revealed that some of the Nissan Nissan its Nissan Leaf electric car is vulnerable to hacker attacks, the vehicle-mounted system vulnerability will allow an attacker to hijack a car's air conditioning and temperature control system. ! Troy Hunt reported that...

Troy Hunt Explains Nissan Leaf Car Hack

Last month, when researcher Troy Hunt argued the dangers of insecure APIs at a security workshop, little did he know hours later he would discover an API vulnerability that allowed remote access to onboard computers of 200,000 Nissan Leaf and eNV200 electric automobiles. “After talking about the...

Nissan Car Hack Allowed Remote Access To Car

Automaker Nissan deactivated a remote access feature that let owners of its Leaf electric car remotely adjust climate controls and check battery status via a smartphone app. The move comes after a security researcher posted his finding regarding a simple hack that allowed anyone with the right Le...

SUSE SLED11 / SLES11 Security Update : xfsprogs (SUSE-SU-2015:2383-1)

xfsprogs was updated to fix one security vulnerability and several bugs. - Handle unwanted data disclosure in xfsmetadump bsc939367, CVE-2012-2150 - Fix segfault during xfsrepair run bsc911866 - Fix definition of leaf attribute block to avoid gcc optimization xfsprogs-fix-leaf-block-definition No...

nss: use-after-poison in sec_asn1d_parse_leaf() (MFSA 2015-133)

A use-after-poison flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library...

DEBIAN-CVE-2015-1793

The X509verifycert function in crypto/x509/x509vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger...