SUSE-SU-2016:2385-1 Security update for libtcnative-1-0

This update for libtcnative-1-0 fixes the following issues: - CVE-2015-4000: Disable 512-bit export-grade cryptography to prevent Logjam vulnerability bsc938945...

openSUSE Security Update : libtcnative-1-0 (openSUSE-2016-1064) (Logjam)

This update for libtcnative-1-0 fixes the following issues : - Disable 512-bit export-grade cryptography to prevent Logjam vulnerability CVE-2015-4000 bsc938945 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

SUSE SLES12 Security Update : libtcnative-1-0 (SUSE-SU-2016:2209-1) (Logjam)

This update for libtcnative-1-0 fixes the following issues : - Disable 512-bit export-grade cryptography to prevent Logjam vulnerability CVE-2015-4000 bsc938945 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE-SU-2016:2209-1 Security update for libtcnative-1-0

This update for libtcnative-1-0 fixes the following issues: - Disable 512-bit export-grade cryptography to prevent Logjam vulnerability CVE-2015-4000 bsc938945...

SUSE SLES11 Security Update : mysql (SUSE-SU-2016:1618-1) (Logjam)

This update for mysql fixes the following issues : - bsc959724: fix incorrect usage of sprintf/strcpy that caused possible buffer overflow issues at various places On SUSE Linux Enterprise 11 SP4 this fix was not yet shipped : - Increase the key length to 2048 bits used in vio/viosslfactories.c f...

openSUSE Security Update : python3 (openSUSE-2016-997) (httpoxy)

This update for python3 fixes the following issues : - apply fix for CVE-2016-1000110 - CGIHandler: sets environmental variable based on user-supplied Proxy request header fixes boo989523, CVE-2016-1000110 - update to 3.4.5 check: https://docs.python.org/3.4/whatsnew/changelog.html fixes boo98475...

Export-Grade Crypto Patching Improves

LAS VEGAS – The FREAK, LOGJAM and DROWN attacks of the last 17 months weren’t just the work of academics and security researchers who found a cool way to unmask encrypted traffic. They were ugly reminders of the Crypto Wars of the 1990s and why export-grade cryptography and intentional encryption...

[SECURITY] [DLA 507-1] nss security update

Package : nss Version : 2:3.14.5-1+deb7u7 CVE ID : CVE-2015-4000 Debian Bug : N/A A vulnerability has been found in nss. CVE-2015-4000 With TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which...

Cisco ACE 4710 Appliance / ACE30 Module Multiple Vulnerabilities (Logjam)

The Cisco Application Control Engine ACE software installed on the remote Cisco ACE 4710 device or ACE30 module is version A5 prior to A53.3. It is, therefore, affected by multiple vulnerabilities : - An invalid free memory error exists due to improper validation of user-supplied input when a DTL...

GLSA-201605-06 : Mozilla Products: Multiple vulnerabilities (Logjam) (SLOTH)

The remote host is affected by the vulnerability described in GLSA-201605-06 Mozilla Products: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and Thunderbird. Please review the CVE identifiers referenced below for details. Impact : A remote attacker...

SolarWinds Storage Resource Monitor Profiler < 6.2.3 Multiple Vulnerabilities (Logjam) (POODLE)

The version of SolarWinds Storage Resource Monitor SRM Profiler formerly SolarWinds Storage Manager running on the remote host is prior to 6.2.3. It is, therefore, affected by multiple vulnerabilities : - A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due t...

HP System Management Homepage < 7.5.4 Multiple Vulnerabilities (Logjam)

According to the web server's banner, the version of HP System Management Homepage SMH hosted on the remote web server is a version prior to 7.5.4. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists when processing an ECParameters structure du...

GLSA-201603-11 : Oracle JRE/JDK: Multiple vulnerabilities (Logjam)

The remote host is affected by the vulnerability described in GLSA-201603-11 Oracle JRE/JDK: Multiple vulnerabilities Multiple vulnerabilities exist in both Oracles JRE and JDK. Please review the referenced CVEs for additional information. Impact : Remote attackers could gain access to informatio...

AIX OpenSSL Advisory : openssl_advisory17.asc (Logjam)

The version of OpenSSL installed on the remote AIX host is affected by the following vulnerabilities : - A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete...

DROWN Vulnerability Remains 'High' Risk, Firms Say

Despite the rush to patch systems at risk to the massive transport layer security TLS vulnerability, known as DROWN, hundreds of cloud services are still at risk of attack. According to two independent research firms, Netskope and Skyhigh Networks, a week after the vulnerability was identified...

Vulnerabilities in OpenSSL affect AIX

IBM SECURITY ADVISORY First Issued: Wed Mar 2 08:43:07 CST 2016 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory17.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory17.asc...

AIX 7.1 TL 3 : bos.net.tcp.client (U867672)

The remote host is missing AIX PTF U867672, which is related to the security of the package bos.net.tcp.client. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...

openSUSE Security Update : socat (openSUSE-2016-215) (Logjam)

This update for socat fixes the following issues : Changes in socat : - update to 1.7.3.1, security fixes : - Socat security advisory 7 and MSVR-1499: 'Bad DH p parameter in OpenSSL' boo938913 and CVE-2015-4000. - Socat security advisory 8: 'Stack overflow in arguments parser' boo964844 - Update ...

SUSE-SU-2016:0344-1 Security update for socat

This update for socat fixed the following issues: - bsc964844: Fixed security advisory 8, Stack overflow in parser, http://www.openwall.com/lists/oss-security/2016/02/01/5. - bsc938913: Improved resilience against Logjam attacks CVE-2015-4000 by increasing the size of the default DH group from 51...

openSUSE Security Update : openldap2 (openSUSE-2016-102) (Logjam)

This update fixes the following security issues : - CVE-2015-6908: The bergetnext function allowed remote attackers to cause a denial of service reachable assertion and application crash via crafted BER data, as demonstrated by an attack against slapd. bsc945582 - CVE-2015-4000: Fix weak...