USN-2372-1: Firefox vulnerabilities

Bobby Holley, Christian Holler, David Bolter, Byron Campen, Jon Coppeard, Carsten Book, Martijn Wargers, Shih-Chiang Chien, Terrence Cole and Jeff Walden discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could...

Amazon Linux AMI : openssl098e (ALAS-2014-350)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 C Tenable Network...

CVE-2014-6940

The Absolute Lending Solutions aka com.soln.S008F6C05EC0B63264B429F6D76286562 application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6904

The CVE-2014-6904 entry concerns The Safe Browser - The Web Filter (aka com.cloudacl) Android app version 1.2.5. The vulnerability is that it does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. T...

CVE-2014-7046

The George Wassouf aka com.devkhr32.georgewassouf application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

F5 Networks BIG-IP : OpenSSL vulnerability (K15158)

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

Apache Subversion 1.0.x - 1.7.17 / 1.8.x < 1.8.10 Multiple Vulnerabilities

The version of Subversion Server installed on the remote host is version 1.x.x prior to 1.7.18 or 1.8.x prior to 1.8.10. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Serf RA layer. This flaw causes wildcards for HTTPS connections to be improperly evaluated,...

CVE-2014-6908

The Forum IC aka com.tapatalk.forumimmigrercom application 3.3.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6914

The Houcine El Jasmi aka com.devkhr31.houcineeljasmi application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The diziturky HD 2015 aka com.adv.diziturky application 2014 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Dubrovnik Guided Walking Tours aka com.mytoursapp.android.app351 application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6921

The CVE-2014-6921 entry affects the Buckhorn Grill (com.orderingapps.buckhorn) Android app version 2.8. It describes a failure to verify X.509 certificates from SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted certificate. The NVD entry provi...

CVE-2014-6918

The CVE-2014-6918 entry affects the Android app “The Bikers Underground” (also listed as hr.ap.n66871172), version 4.5.10. The root cause is failure to verify X.509 certificates when connecting to SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive data via craft...

CVE-2014-6913

The Dive The World aka com.paperton.wl.divetheworld application 1.53 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6907

The CVE-2014-6907 entry covers the Rakuten Install (co.jp.rakuten.installapp) Android app v1.5.0, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. Public ...

CVE-2014-6912

The CVE-2014-6912 entry relates to the Android app for The IRA’s 59th Annual Conference (package com.coreapps.android.followme.ira_14), version 6.0.7.6. The connected documents confirm a root cause: the app does not verify X.509 certificates from SSL servers. Impact stated in the sources is that ...

CVE-2014-6930

The CVE-2014-6930 issue affects the Android app “The Abram Radio Groove!” (com.nobexinc.wls_79226887.rc) version 3.2.3. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via...

CVE-2014-6931

CVE-2014-6931 affects the Treves Dance Center Android app (package com.myapphone.android.myapptrvesdancecenter, version 1.0). The flaw is that the app does not verify X.509 SSL certificates, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certi...