CentOS 4 : firefox (CESA-2006:0733)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox...

Experts call for better measurement of security

If there’s one key message coming through all of the noise at the RSA Conference this week it’s the fact that there’s a pressing need for more data. Data on attacks, data on vulnerabilities, data on data breaches, data on software security, data on everything having to do with security. The...

Researcher wants hacker groups hounded mercilessly

From ComputerWorld Gregg Keizer Criminal cybergangs must be harried, hounded and hunted computerworld.com until they’re driven out of business, a noted botnet researcher said today as he prepared to pitch a new anti-malware strategy later this week at the RSA Conference in San Francisco. “We need...

RSA keynote: Coviello calls for collaboration

From GCN William Jackson The rapidly evolving collaborative information infrastructure offers developers an opportunity to create true security by building it into information technology systems, said Arthur Coviello, president of RSA, EMC’s security division. “We are at a critical inflexion poin...

Google tackles cloud security

Google has a reputation for being open and transparent with many of its initiatives and internal workings, but one of the things that the company hasn’t talked much about publicly until recently is security. In this interview with SearchSecurity.com, the director of security for Google Apps, Eran...

RSA 2009: 'History Repeats Itself'

I am very excited to be guest blogging about RSA here on Threatpost. A special thank you to Dennis and Ryan for the privilege. I am also very excited to once again be speaking at RSA this year. Last year, I was on a panel with Mike Rothman, Rich Mogull, Martin McKeay and Ron Woerner titled...

Economy, SMB security to dominate at RSA Conference

As a security show, the RSA Conference leaves a lot to be desired. Its technical sessions carry an uncomfortable load of marketing baggage and don’t have either the cachet or entertaining edge of those at Black Hat or CanSecWest. Anyone will tell you that the real business of RSA is happening off...

Mike Mimoso on the RSA Conference, Security Budgets and SMB Security

Dennis Fisher talks with Mike Mimoso, editor of Information Security magazine, about the story lines we’re likely to see at the RSA Conference, including virtualization and cloud security, as well as the effect of the economy on security budgets. Download Subscribe to the Digital Underground...

The hype factor at the RSA conference

From CNet Jon Oltsik It’s nearly time for that annual spring ritual: the RSA Conference at the Moscone Center in San Francisco. ESG data tells me that, despite the recession, global organizations continue to spend on security products. So I expect another good show, though I do anticipate that th...

Security budget issues to resonate at RSA Conference

From SearchSecurity Robert Westervelt The glum economy has put increased pressure on CISOs to cut costs while maintaining the same security defenses. Tightening budgets, coupled with increased compliance demands could have security professionals looking for answers next week at the 2009 RSA...

Mandriva Update for openssl MDKSA-2007:193 (openssl)

Check for the Version of openssl OpenVAS Vulnerability Test Mandriva Update for openssl MDKSA-2007:193 openssl Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for openssl MDKSA-2007:193 (openssl)

Check for the Version of openssl OpenVAS Vulnerability Test Mandriva Update for openssl MDKSA-2007:193 openssl Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

Design/Logic Flaw

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

DEBIAN-CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

CVE-2007-6721

CVE-2007-6721 concerns the Legion of the Bouncy Castle Java Cryptography API (used in Crypto Provider Package) up to release 1.38; a Bleichenbacher vulnerability affects simple RSA CMS signatures without signed attributes. The exact impact is described as unknown in some sources, with remote atta...

CVE-2007-6721

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."...

PT-2009-1169 · Bouncy Castle · Crypto Provider Package +1

Name of the Vulnerable Software and Affected Versions: Bouncy Castle Java Cryptography API versions prior to 1.38 Crypto Provider Package versions prior to 1.36 Description: The issue is related to a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes, which has...

CVE-2009-0789

OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service invalid memory access and application crash by placing this structure in the public key of a certificate, as demonstrated by ...

Vulnerability in OpenSSL CVE-2009-0789

When a malformed ASN1 structure is received it’s contents are freed up and zeroed and an error condition returned. On a small number of platforms where sizeoflong sizeofvoid for example WIN64 this can cause an invalid memory access later resulting in a crash when some invalid structures are read,...