SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

PT-2016-6830 · Red Hat · Red Hat Jboss Operations Network

Name of the Vulnerable Software and Affected Versions: Red Hat JBoss Operations Network JON affected versions not specified Description: The issue allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization, when SSL authentication is not...

CVE-2016-0248

IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors...

Cisco Firepower Management Center and FireSIGHT System Software Security Bypass Vulnerability (CNVD-2016-08193)

Cisco Firepower Management Center and FireSIGHT System Software are management center software from Cisco USA. A security vulnerability exists in Cisco Firepower Management Center and Cisco FireSIGHT System that allows an attacker to bypass configured SSL inspection rules with a specially crafted...

Mozilla: Integer overflow and memory corruption in WebSocketChannel (MFSA 2016-75, MFSA 2016-86)

Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR 45.4 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via crafted packets that trigger incorrect buffer-resize operations durin...

CVE-2016-6399

Cisco ACE30 Application Control Engine Module through A5 3.3 and ACE 4700 Application Control Engine appliances through A5 3.3 allow remote attackers to cause a denial of service device reload via crafted 1 SSL or 2 TLS packets, aka Bug ID CSCvb16317...

DEBIAN-CVE-2016-3890

The Java Debug Wire Protocol JDWP implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842...

UBUNTU-CVE-2016-3890

The Java Debug Wire Protocol JDWP implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842...

Raptor Web Application Firewall

Raptor Web Application Firewall Raptor Web Application Firewall is a simple web application firewall made in C, using KISS principle , to make poll use select function, is not better than epoll or kqueue from BSD but is portable, the core of match engine using DFA to detect XSS, SQLi and path...

CVE-2016-6899

The Intelligent Baseboard Management Controller iBMC in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, a...

UnrealIRCd SSL Certificate Spoofing Vulnerability

UnrealIRCd is an IRC service program. A security vulnerability exists in UnrealIRCd SSL certificates that allows an attacker to spoof valid certificates...

Inspircd SSL Certificate Spoofing Vulnerability

InspIRCd is an extensible and modular Internet Relay Chat IRC server written in C++ for Linux, BSD, Windows and Mac OS X systems. Inspircd suffers from a security vulnerability. An attacker can exploit this vulnerability to spoof valid certificates...

USN-3070-4 linux-lts-xenial vulnerabilities

USN-3070-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. A missing permission check when settings ACLs was discovered in nfsd. A local user cou...

Ubuntu: Security Advisory (USN-3071-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SSL/TLS Protocol Information Disclosure Vulnerability in Multiple Red Hat Products

Red Hat Enterprise Linux and others are products of the United States Red Hat.Red Hat Enterprise Linux RHEL is a suite of Linux operating systems for enterprise users maintained and distributed by Red Hat, Inc.Red Hat JBoss Web Server is a Web server built on top of Apache and Tomcat.SSL/TLS is t...

IBM Security Privileged Identity Manager Authentication Vulnerability

IBM Security Privileged Identity Manager is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM USA, that protects, automates, and audits the use of privileged identities to help defend against insider threats and improve security...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code

The vulnerability of WebRTC sockets in Firefox and Firefox ESR browsers relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using incorrect free operations on DTLS objects during the termination of a WebRTC session...

FreeBSD : FreeBSD -- Resource exhaustion due to sessions stuck in LAST_ACK state (0c064c43-600a-11e6-a6c3-14dae9d210b8)

TCP connections transitioning to the LASTACK state can become permanently stuck due to mishandling of protocol state in certain situations, which in turn can lead to accumulated consumption and eventual exhaustion of system resources, such as mbufs and sockets. Impact : An attacker who can...

The vulnerability of the Android operating system, which allows a hacker to increase their privileges

The vulnerability of the Android operating system’s socket subsystem is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created application that utilizes the AFMSMIPC socket, or any other socket not...

CVE-2016-3762

The sockets subsystem in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application that uses 1 the AFMSMIPC socket class or 2 another socket class that is unrecognized by SELinux, aka internal bug 28612709...