153 matches found
sslscan - tests SSL/TLS enabled services to discover supported cipher suites
This is a fork of ioerror's version of sslscan the original readme of which is included below. Changes are as follows: Highlight SSLv2 and SSLv3 ciphers in output. Highlight CBC ciphers on SSLv3 POODLE. Highlight 3DES and RC4 ciphers in output. Highlight PFS+GCM ciphers as good in output. Highlig...
OpenSSL 1.1.0a1.1.0b - Denial of Service
OpenSSL 1.1.0a1.1.0b - Denial of Service Exploit Title: OpenSSL 1.1.0a & 1.1.0b Heap Overflow Remote DOS vulnerability Date: 11-12-2016 Software Link: https://www.openssl.org/source/old/1.1.0/ Exploit Author: Silverfox Contact: http://twitter.com/Silverfox Website: https://www.silverf0x00.com/ CV...
SUSE-SU-2016:2470-2 Security update for nodejs4
This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues: Nodejs embedded openssl version update + upgrade to 1.0.2j CVE-2016-6304, CVE-2016-2183, CVE-2016-2178, CVE-2016-6306, CVE-2016-7052 + remove support for dynamic 3rd party engine modules http: Properly...
OpenSSL 1.1.0 < 1.1.0b Multiple Vulnerabilities
Binary data 9628.prm...
ALPINE-CVE-2016-2177
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and application crash or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3srvr....
OpenSSL 1.0.1 < 1.0.1t Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.1t. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1t advisory. - The X509NAMEoneline function in crypto/x509/x509obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to...
CVE-2016-0800
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by...
OpenSSL 1.0.2 < 1.0.2d Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.2d. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2d advisory. - ssl/s3clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client,...
OpenSSL 1.0.0 < 1.0.0s Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.0s. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0s advisory. - The dofreeupto function in crypto/cms/cmssmime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2...
Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality of protected information
Multiple vulnerabilities in the openssl package up to version 1.0.1g of the Gentoo Linux operating system. Exploitation of these vulnerabilities may lead to violations of the confidentiality of protected information. These vulnerabilities can be exploited remotely...
Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information
The multiple vulnerabilities in the openssl-0.9.6b package of the Red Hat Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
Vulnerabilities of the CentOS operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information
The multiple vulnerabilities in the openssl-0.9.7a package of the CentOS operating system can lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information
The multiple vulnerabilities in the openssl-0.9.5a package of the Red Hat Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...
The vulnerability of the OpenSUSE operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the compat-openssl097g-debuginfo-32bit package of the OpenSUSE operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...
CVE-2015-0285
The ssl3clienthello function in s3clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force...
CVE-2014-3568
OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23clnt.c and s23srvr.c...
OpenSSL 1.0.1 < 1.0.1i Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.1i. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1i advisory. - The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service...
OpenSSL <= 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS
No description provided by source. / cve-2009-1378.c OpenSSL = 0.9.8k, 1.0.0-beta2 DTLS Remote Memory Exhaustion DoS Jon Oberheide [email protected] http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378 In dtls1processoutofseqmessage the check if the...
CVE-2014-0224
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...