Ubuntu: Security Advisory (USN-2232-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-34 KDE Libraries: Multiple vulnerabilities Multiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could cause a...

Ubuntu 14.04 LTS : OpenSSL regression (USN-2232-3)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2232-3 advisory. USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use renegotiation, such as...

USN-2232-3: OpenSSL regression

USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for CVE-2014-0224 caused a regression for certain applications that use renegotiation, such as PostgreSQL. This update fixes the problem. Original advisory details: Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS...

GLSA-201406-21 : cURL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-21 cURL: Multiple vulnerabilities Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could cause a man-in-the-middle attack via ...

Ubuntu: Security Advisory (USN-2246-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-2001

The CVE-2014-2001 entry concerns the JR East Japan Android app (prior to version 1.2.0). The underlying issue is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to obtain sensitive information via a crafted certificate. Impact is information disclosure of...

Ubuntu 14.04 LTS : APT vulnerability (USN-2246-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2246-1 advisory. Jakub Wilk discovered that APT did not correctly validate signatures when downloading source packages. If a remote attacker were able to perform a...

USN-2247-1: OpenStack Nova vulnerabilities

Darragh O'Reilly discovered that the Ubuntu packaging for OpenStack Nova did not properly set up its sudo configuration. If a different flaw was found in OpenStack Nova, this vulnerability could be used to escalate privileges. This issue only affected Ubuntu 13.10 and Ubuntu 14.04 LTS...

USN-2246-1: APT vulnerability

Jakub Wilk discovered that APT did not correctly validate signatures when downloading source packages. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered source packages...

CVE-2014-0478

APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature...

CVE-2014-0478

APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64 (20140605)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 Note: In order to...

CVE-2014-1771

CVE-2014-1771 affects Microsoft Internet Explorer 6–11 with SChannel, where during TLS renegotiation the server certificate may differ from the pre-renegotiation one. This allows MITM attackers to obtain sensitive information or modify TLS session data via a triple handshake attack. Public exploi...

Important: Red Hat Security Advisory: openssl098e security update

Updated openssl098e packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

SSL/TLS: OpenSSL CCS Man in the Middle Security Bypass Vulnerability

OpenSSL is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-5583

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

MGASA-2014-0255 Updated openssl packages fix multiple vulnerabilties

Updated openssl packages fix security vulnerabilities: It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a...

Scientific Linux Security Update : openssl097a and openssl098e on SL5.x, SL6.x i386/x86_64 (20140605)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 Note: In order to...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-2232-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2232-1 advisory. Jri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting...