Oracle Linux 6 / 7 : gnutls (ELSA-2016-0012)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-0012 advisory. 3.3.8-14 - Prevent downgrade attack to RSA-MD5 in server key exchange. 3.3.8-13 - Corrected reseed and respect of maxnumberofbitsperrequest in FIPS140-2 mod...

gnutls security update

3.3.8-14 - Prevent downgrade attack to RSA-MD5 in server key exchange. 3.3.8-13 - Corrected reseed and respect of maxnumberofbitsperrequest in FIPS140-2 mode. Also enhanced the initial tests. 1228199...

py-rsa -- Bleichenbacher'06 signature forgery vulnerability

Filippo Valsorda reports: python-rsa is vulnerable to a straightforward variant of the Bleichenbacher'06 attack against RSA signature verification with low public exponent...

CVE-2015-6851

EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...

Code injection

EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...

CVE-2015-6851

EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...

CVE-2015-6851

MODE C: CVE-2015-6851 affects EMC RSA SecurID Web Agent before 8.0. The vulnerability enables physically proximate attackers to bypass the privacy-screen by using an unattended workstation and running DOM Inspector. The available sources (NVD and CNVD variants) describe a local access path leadin...

EMC RSA SecurID Web Agent Local Authentication Bypass Vulnerability

EMC RSA SecurID Web Agent is a cross-platform, Web-based solution from EMC that intercepts remote user access or user group local requests and directs them to the RSA Authentication Management Server for authentication. A local authentication bypass vulnerability exists in EMC RSA SecurID Web Age...

OpenSSL 'PSS' parameter Denial of Service Vulnerability - Windows

OpenSSL is prone to a Denial of Service DoS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...

F5 Networks BIG-IP : OpenSSL vulnerability (K86772626)

crypto/rsa/rsaameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an RSA PSS ASN.1 signature that lacks a mask generation function parameter. CVE-2015-3194 C Tenable Network Security...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20151214)

A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication. CVE-2015-3194 A memory leak...

openssl security update

CentOS Errata and Security Advisory CESA-2015:2617 Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base score...

OpenSSL: Certificate verify crash with missing PSS parameter

A NULL pointer dereference flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacker could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication...

SOL91245485 - RSA-CRT key leak vulnerability CVE-2015-5738

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

Medium: openssl

Issue Overview: A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication. CVE-2015-3194...

RHEL 6 / 7 : openssl (RHSA-2015:2617)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2617 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a...

Xerox WorkCentre 6400 OpenSSL RSA Temporary Key Handling EXPORT_RSA Ciphers Downgrade MitM (XRX15AP) (FREAK)

According to its model number and software version, the remote Xerox WorkCentre 6400 device is affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less than or equal to 512 bits. A...

OpenSSL 1.0.2 < 1.0.2e Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2e. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2e advisory. - The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, a...

DEBIAN-CVE-2015-3194

crypto/rsa/rsaameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an RSA PSS ASN.1 signature that lacks a mask generation function parameter...

CVE-2015-3194

crypto/rsa/rsaameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an RSA PSS ASN.1 signature that lacks a mask generation function parameter...