Mac OS X : Cisco AnyConnect Secure Mobility Client < 3.1(7021) <= 4.0(48) Multiple Vulnerabilities (FREAK)

The remote Mac OS X host has a version of Cisco AnyConnect Secure Mobility Client installed that is prior to 3.1.7021.0, or else it is a version equal or prior to 4.0.0048.0. It is, therefore, affected by multiple vulnerabilities in the OpenSSL library : - The BIGNUM squaring BNsqr implementation...

CVE-2015-0282

GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

Code injection

GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

CVE-2015-0282

GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

CVE-2015-0282

GnuTLS before 3.1.0 does not verify that the RSA PKCS#1 signature algorithm matches the signature algorithm in the certificate, enabling remote downgrade attacks via unspecified vectors. Impact is downgrade/traffic manipulation risk with affected deployments. The CVE entry explicitly targets GnuTLS...

CVE-2015-0282

GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

GLSA-201503-11 : OpenSSL: Multiple vulnerabilities (FREAK)

The remote host is affected by the vulnerability described in GLSA-201503-11 OpenSSL: Multiple vulnerabilities Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers and the upstream advisory referenced below for details: RSA silently downgrades to EXPORTRSA Client...

OpenSSL 1.0.2 < 1.0.2a Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2a. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2a advisory. - An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8z...

Updated firefox packages fix security vulnerabilities

A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileges of the user invoking Firefox...

FreeBSD : OpenSSL -- multiple vulnerabilities (9d15355b-ce7c-11e4-9db0-d050992ecde8) (FREAK)

OpenSSL project reports : - Reclassified: RSA silently downgrades to EXPORTRSA Client CVE-2015-0204. OpenSSL only. - Segmentation fault in ASN1TYPEcmp CVE-2015-0286 - ASN.1 structure reuse memory corruption CVE-2015-0287 - PKCS7 NULL pointer dereferences CVE-2015-0289 - Base64 decode CVE-2015-029...

Null pointer dereference

The ASN.1 signature-verification implementation in the rsaitemverify function in crypto/rsa/rsaameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service NULL pointer dereference and application crash via crafted RSA PSS parameters to an endpoint that uses the...

CVE-2015-0208

The ASN.1 signature-verification implementation in the rsaitemverify function in crypto/rsa/rsaameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service NULL pointer dereference and application crash via crafted RSA PSS parameters to an endpoint that uses the...

Vulnerability in OpenSSL - Segmentation fault for invalid PSS parameters

Segmentation fault for invalid PSS parameters. The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can ...

PT-2015-1684 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 1.0.2a Description: The issue is related to the ASN.1 signature-verification implementation in the rsa item verify function. It allows remote attackers to cause a denial of service, resulting in a NULL pointer...

CVE-2015-0208

CVE-2015-0208 : OpenSSL 1.0.2 before 1.0.2a is vulnerable in the RSA PSS signature verification (rsa_ameth.c) where crafted ASN.1 parameters can trigger a NULL pointer dereference in certificate verification, leading to service denial. Affected product/version: OpenSSL 1.0.2 up to but not includi...

lib32-openssl: multiple issues

CVE-2015-1787 denial of service If client auth is used then a server can segfault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. - CVE-2015-0207 denial of service The DTLSv1listen...

OpenSSL: Multiple vulnerabilities

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers and the upstream...

OpenSSL -- multiple vulnerabilities

OpenSSL project reports: Reclassified: RSA silently downgrades to EXPORTRSA Client CVE-2015-0204. OpenSSL only. Segmentation fault in ASN1TYPEcmp CVE-2015-0286 ASN.1 structure reuse memory corruption CVE-2015-0287 PKCS7 NULL pointer dereferences CVE-2015-0289 Base64 decode CVE-2015-0292. OpenSSL...

CVE-2015-0208

The ASN.1 signature-verification implementation in the rsaitemverify function in crypto/rsa/rsaameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service NULL pointer dereference and application crash via crafted RSA PSS parameters to an endpoint that uses the...

UBUNTU-CVE-2015-2319

The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204...