OpenSSL OOB Memory Access Vulnerability (20241016) - Linux

OpenSSL is prone to an out of bound OOB memory access vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle MySQL Server 9.x < 9.1.0 (January 2025 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging Kerberos. Supported versions that are affected are 8.0.39 and...

CVE-2024-9143

A flaw was found in OpenSSL. Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. X9.62 encoding is used for ECC keys in X.509 certificates, so problematic inputs cannot occur in the context of...

CVE-2024-9143 vulnerabilities

Vulnerabilities for packages: openssl, libcrypto3-2.34, openssl-provider-fips...

CVE-2024-9143 vulnerabilities

Vulnerabilities for packages: openssl...

OpenSSL 缓冲区错误漏洞

OpenSSL is an open source general-purpose cryptographic library capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols from the OpenSSL team. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

OpenSSL 3.3.0 < 3.3.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.3.3. It is, therefore, affected by a vulnerability as referenced in the 3.3.3 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

Low-level invalid GF(2^m) parameters lead to OOB memory access

Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution,...

OpenSSL 1.1.1 < 1.1.1zb Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.1.1zb. It is, therefore, affected by a vulnerability as referenced in the 1.1.1zb advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

OpenSSL 3.1.0 < 3.1.8 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.8. It is, therefore, affected by a vulnerability as referenced in the 3.1.8 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

OpenSSL 3.2.0 < 3.2.4 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.2.4. It is, therefore, affected by a vulnerability as referenced in the 3.2.4 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-boun...

OpenSSL 3.0.0 < 3.0.16 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.0.16. It is, therefore, affected by a vulnerability as referenced in the 3.0.16 advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

OpenSSL 1.0.2 < 1.0.2zl Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2zl. It is, therefore, affected by a vulnerability as referenced in the 1.0.2zl advisory. - Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

OpenSSL -- OOB memory access vulnerability

The OpenSSL project reports: Low-level invalid GF2^m parameters lead to OOB memory access CVE-2024-9143 Low Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes...

CVE-2024-4603 affecting package openssl for versions less than 3.3.2-1

CVE-2024-4603 affecting package openssl for versions less than 3.3.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-6119 affecting package openssl for versions less than 3.3.2-1

CVE-2024-6119 affecting package openssl for versions less than 3.3.2-1. An upgraded version of the package is available that resolves this issue...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-727)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-727 advisory. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-721)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-721 advisory. Issue summary: Applications performing certificate name checks e.g., TLSclients checking server certificates may attempt to read an invalid memoryaddress resulting in abnormal termination of the...

Medium: openssl

Issue Overview: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause...

Medium: openssl

Issue Overview: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers from the client side to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause...