460 matches found
gnutls: Heap-buffer-overflow in _asn1_get_indefinite_length_string
Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=5692057372852224 Project: gnutls Fuzzer: libFuzzergnutlspkcs7parserfuzzer Fuzz target binary: gnutlspkcs7parserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux Crash Type:...
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-977)
This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...
openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-976)
This update for java-170-openjdk fixes the following issues : - Update to 2.6.7 - OpenJDK 7u111 - Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection...
Security update for java-1_7_0-openjdk (important)
This update for java-170-openjdk fixes the following issues: - Update to 2.6.7 - OpenJDK 7u111 Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 - S8147771: Construction of static protection domai...
F5 Networks BIG-IP : PKCS #7 vulnerability (SOL16898)
The PKCS7dataDecodefunction in crypto/pkcs7/pk7doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a PKCS7 blob that uses ASN.1 encoding and lack...
openSUSE Security Update : libressl (openSUSE-2015-916)
LibreSSL was updated to fix two security issues inherited from OpenSSL. The following vulnerabilities were fixed : - CVE-2015-3194: NULL pointer dereference in client side certificate validation - CVE-2015-3195: Memory leak in PKCS7 - not reachable from TLS/SSL %NASLMINLEVEL 70300 C Tenable Netwo...
Oracle Linux 6 / 7 : openssl (ELSA-2015-2617)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2617 advisory. - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509ATTRIBUTE memory leak - fix CVE-2015-3196 - rac...
SUSE SLED11 / SLES11 Security Update : OpenSSL (SUSE-SU-2015:1182-2) (Logjam)
OpenSSL 0.9.8k was updated to fix several security issues : CVE-2015-4000: The Logjam Attack weakdh.org has been addressed by rejecting connections with DH parameters shorter than 1024 bits. 2048-bit DH parameters are now generated by default. CVE-2015-1788: Malformed ECParameters could cause an...
SUSE SLED11 / SLES10 Security Update : OpenSSL (SUSE-SU-2015:1183-2) (Logjam)
OpenSSL was updated to fix several security issues. CVE-2015-4000: The Logjam Attack weakdh.org has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. CVE-2015-1789: An out-of-bounds read in X509cmptime was...
SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2015:1143-1) (Logjam)
This update of openssl fixes the following security issues : - CVE-2015-4000 bsc931698 - The Logjam Attack / weakdh.org - reject connections with DH parameters shorter than 1024 bits - generates 2048-bit DH parameters by default - CVE-2015-1788 bsc934487 - Malformed ECParameters causes infinite...
Security update for openssl (important)
openssl was updated to fix six security issues. The following vulnerabilities were fixed: CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. boo931698 CVE-2015-1788: Malformed ECParameters causes...
SUSE-SU-2015:1143-1 Security update for openssl
This update of openssl fixes the following security issues: - CVE-2015-4000 bsc931698 The Logjam Attack / weakdh.org reject connections with DH parameters shorter than 1024 bits generates 2048-bit DH parameters by default - CVE-2015-1788 bsc934487 Malformed ECParameters causes infinite loop -...
Security Advisory 0011
Security Advisory 0011 PDF Date: June 17th 2015 Revision| Date| Changes ---|---|--- 1.0 | June 17th, 2015 | Initial release 1.1 | November 4th, 2015 | Updated to reflect versions with the fix for tracked bugs. Change in vulnerability status for CVE-2014-8176 Arista Products Vulnerability report f...
CVE-2015-1790
OpenSSL CVE-2015-1790: The PKCS#7 parsing code can trigger a NULL pointer dereference when parsing ASN.1-encoded PKCS#7 blobs with missing EncryptedContent, leading to a denial of service. IBM AIX advisory and Arista advisory confirm the issue and provide fixes; upgrading to the patched OpenSSL r...
Vulnerability in OpenSSL - PKCS7 crash with missing EnvelopedContent
The PKCS7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS7 data or otherwise parse PKCS7 structures from untruste...
SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2015:0541-1)
OpenSSL was updated to fix various security issues. Following security issues were fixed : - CVE-2015-0209: A Use After Free following d2iECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client...
SuSE 11.3 Security Update : OpenSSL (SAT Patch Number 10470)
OpenSSL has been updated to fix various security issues : - A segmentation fault in ASN1TYPEcmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections. CVE-2015-0286 - A ASN.1 structure reuse memory corruption was fixed...
Vulnerability in OpenSSL - PKCS7 NULL pointer dereferences
PKCS7 NULL pointer dereference. The PKCS7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that verify PKCS7 signatures, decrypt PKCS7 da...
OWASP ESAPI Security Advisory: MAC Bypass in ESAPI Symmetric Encryption
OWASP ESAPI for Java Security Advisory 1 The OWASP Foundation MAC Bypass in ESAPI Symmetric Encryption Summary ======= Category: Symmetric cryptography Module: ESAPI Encryptor interface Announced: 2013-08-23 via ESAPI-Dev mailing list...
