USN-810-3: NSS regression

USN-810-1 fixed vulnerabilities in NSS. Jozsef Kadlecsik noticed that the new libraries on amd64 did not correctly set stack memory flags, and caused applications using NSS e.g. Firefox to have an executable stack. This reduced the effectiveness of some defensive security protections. This update...

Ubuntu USN-809-1 (gnutls26)

The remote host is missing an update to gnutls26 announced via advisory USN-809-1. OpenVAS Vulnerability Test $Id: ubuntu8091.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu8091.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-809-1 gnutls26 Authors: Thomas...

Debian Security Advisory DSA 1874-1 (nss)

The remote host is missing an update to nss announced via advisory DSA 1874-1. OpenVAS Vulnerability Test $Id: deb18741.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1874-1 nss Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Google Chrome 'JavaScript' And 'HTTPS' Multiple Vulnerabilities - Aug09

This host is installed with Google Chrome and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodgooglechromemultvulnaug09.nasl 5055 2017-01-20 14:08:39Z teissa $ Google Chrome 'JavaScript' And 'HTTPS' Multiple Vulnerabilities - Aug09 Authors: Sharath S Copyright: Copyrig...

CVE-2009-3045: Undefined Security Weakness

Opera before 10.00 trusts root X.509 certificates signed with the MD2 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted server certificate...

MD2 algorithm used by security certificates is considered weak

Digital signatures made with the MD2 algorithm are used in some of the issuer certificates that Opera trusts. MD2 is now considered weak...

CVE-2009-2973

Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the 1 MD2 or 2 MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409...

Design/Logic Flaw

Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the 1 MD2 or 2 MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409...

CVE-2009-2973

Removed by vendor...

CVE-2009-2973

CVE-2009-2973 affects Google Chrome prior to 2.0.172.43, where SSL connections to a site with an X.509 certificate signed using MD2 or MD4 could be spoofed by a man-in-the-middle. This is related to CVE-2009-2409. Connected documents indicate MD2/MD4 hash-signature weaknesses and that mitigations...

CVE-2009-2973

Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the 1 MD2 or 2 MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409...

CVE-2009-2973: Undefined Security Weakness

Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the 1 MD2 or 2 MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409...

Google Chrome < 2.0.172.43 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 2.0.172.43. Such versions are reportedly affected by multiple issues : - A flaw in the V8 JavaScript engine might allow a specially crafted JavaScript page to access unauthorized data in memory or to execute arbitrary code...

DSA-1874-1 nss - several vulnerabilities

Bulletin has no description...

GnuTLS library certificate spoofing

It's possible to spoof cerificate name with NULL byte; weak MD2-hashed signatures are accepted...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : gnutls12, gnutls13, gnutls26 vulnerabilities (USN-809-1)

Moxie Marlinspike and Dan Kaminsky independently discovered that GnuTLS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications...

USN-809-1: GnuTLS vulnerabilities

Moxie Marlinspike and Dan Kaminsky independently discovered that GnuTLS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications...

RedHat Security Advisory RHSA-2009:1207

The remote host is missing updates to Netscape Portable Runtime NSPR and Network Security Services NSS announced in advisory RHSA-2009:1207. These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7...

RedHat Security Advisory RHSA-2009:1207

The remote host is missing updates to Netscape Portable Runtime NSPR and Network Security Services NSS announced in advisory RHSA-2009:1207. These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7...

Ubuntu USN-810-2 (fixed)

The remote host is missing an update to fixed announced via advisory USN-810-2. Original advisory details: Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of...