PT-2011-1062 · Suse +2 · Ext4Dev-Kmp-Trace +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.38 Description: The issue is related to the Generic Receive Offload GRO implementation in the Linux kernel. A problem in the napi reuse skb function in net/core/dev.c does not reset the values of certain...

FreeBSD : tarsnap -- cryptographic nonce reuse (2c2d4e83-2370-11e0-a91b-00e0815b8da8)

Colin Percival reports : In versions 1.0.22 through 1.0.27 of Tarsnap, the CTR nonce value is not incremented after each chunk is encrypted. The CTR counter is correctly incremented after each 16 bytes of data was processed, but this counter is reset to zero for each new chunk. Note that since th...

openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network...

DEBIAN-CVE-2010-4180

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network...

System: SCEP one-time PIN reuse

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN...

DEBIAN-CVE-2010-3075

EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the las...

tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service application outage or obtain sensitive information via a crafted header that interferes with "recycling...

FreeBSD : mozilla -- multiple vulnerabilities (99858b7c-7ece-11df-a007-000f20797ede)

Mozilla Project reports : MFSA 2010-33 User tracking across sites using Math.random MFSA 2010-32 Content-Disposition: attachment ignored if Content-Type: multipart also present MFSA 2010-31 focus behavior can be used to inject or steal keystrokes MFSA 2010-30 Integer Overflow in XSLT Node Sorting...

Mozilla Foundation Security Advisory 2010-28

Mozilla Foundation Security Advisory 2010-28 Title: Freed object reuse across plugin instances Impact: Critical Announced: June 22, 2010 Reporter: Microsoft Vulnerability Research Products: Firefox, SeaMonkey Fixed in: Firefox 3.6.4 Firefox 3.5.10 SeaMonkey 2.0.5 Description Microsoft Vulnerabili...

Mozilla Firefox 3.6.x < 3.6.4 Multiple Vulnerabilities

Binary data 5580.prm...

Freed object reuse across plugin instances — Mozilla

Microsoft Vulnerability Research reported that two plugin instances could interact in a way in which one plugin gets a reference to an object owned by a second plugin and continues to hold that reference after the second plugin is unloaded and its object is destroyed. In these cases, the first...

Mozilla Foundation Security Advisory 2010-09

Mozilla Foundation Security Advisory 2010-09 Title: Deleted frame reuse in multipart/x-mixed-replace image Impact: Moderate Announced: March 23, 2010 Reporter: regenrecht via TippingPoint's Zero Day Initiative Products: Firefox 3.6 Fixed in: Firefox 3.6.2 Description Security researcher regenrech...

CVE-2010-1135

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...

Design/Logic Flaw

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...

CVE-2010-1135

The userlogout function in TikiWiki CMS/Groupware 4.x before 4.2 does not properly delete user login cookies, which allows remote attackers to gain access via cookie reuse...

CVE-2010-1135

The CVE-2010-1135 issue affects Tiki Wiki CMS/Groupware 4.x prior to 4.2 . The root cause is the user_logout function failing to properly delete user login cookies , allowing a remote attacker to gain access via cookie reuse. Impact is authenticated access through cookie replay, with partial conf...

73 Percent of Users Reuse Banking Passwords

The majority of online banking customers reuse their online-banking login credentials on other websites, according to a new survey on password insecurity. Read the full article. The Register...

Microsoft Internet Explorer Table Layout Reuse Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists when specific elements are used with...

DEBIAN-CVE-2009-3378

The oggplaydatahandletheoraframe function in media/liboggplay/src/liboggplay/oggplaydata.c in liboggplay, as used in Mozilla Firefox 3.5.x before 3.5.4, attempts to reuse an earlier frame data structure upon encountering a decoding error for the first frame, which allows remote attackers to cause...

SOL10674 - Netscape reuse cipher change bug - Qualsys QID 38284

A Qualsys security audit may report that the BIG-IP management IP address is vulnerable to a NETSCAPE REUSE CIPHER CHANGE BUG. The security audit may produce a report that appears similar to the following example: QID: 38284 CVSS Base: 5 1 Category: General remote services CVSS Temporal: 4.7 CVE...