1598 matches found
OpenSSL Competitive Conditional Denial of Service Vulnerability
OpenSSL is an open source implementation of SSL for strong encryption of network communications. A security vulnerability exists in OpenSSL, which can be exploited by a remote attacker to send a special PSK identity that triggers a contention condition and then triggers two releases of memory,...
CVE-2015-1794
The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...
UBUNTU-CVE-2015-1794
The ssl3getkeyexchange function in ssl/s3clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service segmentation fault via a zero p value in an anonymous Diffie-Hellman DH ServerKeyExchange message...
CVE-2008-0166
OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys...
F5 Networks BIG-IP : OpenSSL vulnerability (K17382)
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol...
F5 BIG-IP - OpenSSL vulnerability CVE-2015-0209
The remote host is missing a security patch. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...
SUSE-SU-2015:1889-1 Security update for ruby19
ruby19 was updated to fix two security issues. The following vulnerabilities were fixed: CVE-2015-1855: Ruby OpenSSL hostname verification was too permissive bsc926974. CVE-2009-5147: DL::dlopen could have loaded a library with tainted library name even if $SAFE 0 bsc939860...
F5 Networks BIG-IP : OpenSSL vulnerability (SOL16139) (FREAK)
The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORTRSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role. C Tenable...
F5 Networks BIG-IP : OpenSSL vulnerability (K16914)
Race condition in the ssl3getnewsessionticket function in ssl/s3clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service double free and application crash or...
SOL17248 - OpenSSL vulnerability CVE-2010-0742
Note: As of February 17, 2015, AskF5 Security Advisory articles include the Severity value. Security Advisory articles published before this date do not list a Severity value. Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can...
The vulnerability of the OpenSSL library, which allows attackers to carry out attacks aimed at reducing the security of encryption algorithms
The vulnerability of the OpenSSL library is related to errors in cryptographic transformations. Exploiting this vulnerability allows a malicious actor, operating remotely and having access to the data transmission channel, to carry out attacks aimed at reducing the resilience of encryption...
The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure
The vulnerability of the rsaitemverify function in the OpenSSL library is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to cause service failures by using specially crafted RSA PSS parameters, when these parameters are processed with the...
The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure
The vulnerability of the ssl3getclientkeyexchange function in the OpenSSL library exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to cause a service failure by sending a ClientKeyExchange message of zero length during authentication procedures...
The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure
The vulnerability of the dofreeupto function in the OpenSSL library is related to resource management errors. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures by sending a zero value to the BIO data structure...
The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure
The vulnerability of the PKCS7dataDecode function in the OpenSSL library is related to pointer swapping errors. Exploiting this vulnerability could allow a malicious actor to cause service failures when using the PKCS7 specification...
The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure
The vulnerability of the dtls1listen function in the OpenSSL library is related to pointer dereferencing errors. Exploiting this vulnerability could allow a malicious actor to cause service failure by generating DTLS traffic due to incorrect isolation of independent data streams...
The vulnerability of the BN_GF2m_mod_inv function in the OpenSSL library, which allows a hacker to cause a service failure.
The vulnerability of the BNGF2mmodinv function crypto/bn/bngf2m.c in the OpenSSL library is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions due to errors occurring during the establishment of a connection session. Thi...
The vulnerability of the OpenSSL library, which allows a hacker to bypass the standard procedures for verifying certificate chains
The vulnerability of the X509verifycert function in the OpenSSL library is related to insufficient handling of the X.509 Basic Constraints cA value during the identification of an alternative certificate chain. Exploiting this vulnerability allows a malicious actor to bypass the standard...
MGASA-2015-0291 Updated freeradius package fixes security vulnerability
The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List CRL checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates. An unexpire...
MGASA-2015-0274 Updated openssl package fixes security vulnerability
During certificate verification, OpenSSL starting from version 1.0.1n and 1.0.2b will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted...