openssl: Memory corruption in the ASN.1 encoder

A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an...

ALPINE-CVE-2016-2176

The X509NAMEoneline function in crypto/x509/x509obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service buffer over-read via crafted EBCDIC ASN.1 data...

CVE-2016-2108

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service buffer underflow and memory corruption via an ANY field in crafted serialized data, aka the "negative zero" issue...

ALPINE-CVE-2016-2106

Integer overflow in the EVPEncryptUpdate function in crypto/evp/evpenc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service heap memory corruption via a large amount of data...

ALPINE-CVE-2016-2105

Integer overflow in the EVPEncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service heap memory corruption via a large amount of binary data...

DEBIAN-CVE-2000-1254

crypto/rsa/rsagen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging improper RSA key generation on 64-bit HP-UX platforms...

OpenSSL 1.0.1 < 1.0.1o Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.1o. It is, therefore, affected by a vulnerability as referenced in the 1.0.1o advisory. - The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a deni...

PT-2016-1843

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.1o OpenSSL versions prior to 1.0.2c Description The issue is caused by a buffer overflow in the ASN.1 implementation, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted...

SOL52349521 - OpenSSL vulnerability CVE-2016-2842

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SOL40524634 - OpenSSL vulnerability CVE-2016-0797

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

F5 Networks BIG-IP : OpenSSL vulnerability (K93122894)

Double free vulnerability in the dsaprivdecode function in crypto/dsa/dsaameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a malformed DSA private key. CVE-2016-0705 C...

The vulnerability of the OpenSSL library, which allows a hacker to decrypt the transmitted data

The vulnerability of the OpenSSL library lies in the fact that the SSLv2 protocol requires the server to send a message called ServerVerify before establishing a connection. As a result, the client possesses a portion of the RSA public key. Exploiting this vulnerability allows a remote attacker t...

The vulnerability of the OpenSSL library, which allows a hacker to obtain the secret key

The vulnerability of the DHcheckpubkey function in the crypto/dh/dhcheck.c file of the OpenSSL library is related to errors in gathering input data for the Diffie-Hellman algorithm. Exploiting this vulnerability could allow a remote attacker to obtain the secret key by repeatedly using the...

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the SRPVBASEgetbyuser function implementation in the OpenSSL library is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause a service failure e.g., excessive memory consumption by entering an invalid user name during a...

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure or cause other adverse effects

The vulnerability of the dsaprivdecode function crypto/dsa/dsaameth.c in the OpenSSL library is related to the reallocation of memory. Exploiting this vulnerability allows a remote attacker to cause a service failure or other effects such as memory corruption by using an altered private DSA key...

The vulnerability of the get_client_master_key function in the SSLv2 implementation of the OpenSSL library allows a hacker to disclose sensitive information.

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure...

OpenSSL: SSLv2 doesn't block disabled ciphers

A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks...

CVE-2016-2842

The doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service out-of-bounds write or memory consumption or possibly have unspecified other...

DEBIAN-CVE-2016-2842

The doaproutch function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service out-of-bounds write or memory consumption or possibly have unspecified other...

CVE-2016-0799

The fmtstr function in crypto/bio/bprint.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service overflow and out-of-bounds read or possibly have unspecified other impact via a long string, as...