2427 matches found
SuSE 11.3 Security Update : compat-openssl097g (SAT Patch Number 10033)
The SLES 9 compatibility package compat-openssl097g received a roll up update fixing various security issues : - Build option no-ssl3 is incomplete. CVE-2014-3568 - Add support for TLSFALLBACKSCSV. CVE-2014-3566 - Information leak in pretty printing functions. CVE-2014-3508 - OCSP bad key DoS...
OracleVM 2.2 : openssl (OVMSA-2014-0007)
The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...
OracleVM 3.2 : onpenssl (OVMSA-2014-0008)
The remote OracleVM system is missing necessary patches to address critical security updates : - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability - replace expired GlobalSign Root CA certificate in ca-bundle.crt - fix for CVE-2013-0169 - SSL/TLS CBC timing attack 907589 - fix for CVE-2013-0166 ...
[SECURITY] Fedora 19 Update: polarssl-1.2.12-1.fc19
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...
Combined with the middleman attack, the Pidgin tasteless vulnerability becomes waste into treasure-vulnerability warning-the black bar safety net
The latest version of the open source instant messaging clientPidgin 2.10.10 all this time to fix a series of vulnerabilities, wherein the SSL/TLS certificate validation issue can be exploited by hackers to make MiTM attacks. As a result, some slightly tasteless the vulnerability with man in the...
Windows secure channel remote code execution vulnerability, CVE-2 0 1 4-6 3 2 1）Analysis-vulnerability warning-the black bar safety net
I. background Windows secure channel Secure Channel, Schannel）surprise the reported vulnerability, Microsoft recently released as a major grade MS14-0 6 6 information security Bulletin, revealed in the Schannel remote code execution vulnerability, CVE-2 0 1 4-6 3 2 1 in. The affected Microsoft...
MGASA-2014-0449 Updated claws-mail package fixes security vulnerability
This update provides claws-mail version 3.11.1, which includes several fixes and improvements related to SSL/TLS, and fixes other bugs as well. See the upstream news for more details...
Updated claws-mail package fixes security vulnerability
This update provides claws-mail version 3.11.1, which includes several fixes and improvements related to SSL/TLS, and fixes other bugs as well. See the upstream news for more details...
openSUSE Security Update : pidgin (openSUSE-SU-2014:1397-1)
Update to version 2.10.10 : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and GnuTLS plugins...
Microsoft Schannel Bug Latest in Long Line of Serious Crypto Flaws
The critical vulnerability in the Schannel technology in Windows that Microsoft patched Tuesday is ripe for exploitation, experts say, and continues the long line of severe vulnerabilities in major SSL/TLS implementations in recent months. Secure Channel, also known as Schannel, is a technology...
openSUSE Security Update : pidgin (openSUSE-SU-2014:1376-1)
The following issues were fixed in this update : + General : - Check the basic constraints extension when validating SSL/TLS certificates. This fixes a security hole that allowed a malicious man-in-the-middle to impersonate an IM server or any other https endpoint. This affected both the NSS and...
Pidgin 2.10.10 Patches SSL MiTM, DoS Vulnerabilities
A handful of security vulnerabilities were patched in the most recent release of the Pidgin open source instant messaging client, Pidgin 2.10.10, including a SSL/TLS certificate validation issue that could be exploited in man-in-the-middle attacks. Reported by Jacob Appelbaum of the Tor Project,...
[SECURITY] Fedora 21 Update: polarssl-1.3.9-1.fc21
PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...
ZTE 831CII Hardcoded Credential / XSS / CSRF
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials. Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home%27;alert%280%29;//&enblUpnp=1&enblLan2=0 Any user browsing to...
DigiCert Considering Certs for Hidden Services
News broke last week that Facebook had built a hidden services version of its social network available to users browsing anonymously via the Tor Project’s proxy service. Unlike any .onion domain before it, Facebook’s would be verified by a legitimate digital signature, signed and issued by...
Google Releases Nogotofail Tool to Test Network Security
The last year has produced a rogues’ gallery of vulnerabilities in transport layer security implementations and new attacks on the key protocols, from Heartbleed to the Apple gotofail flaw to the recent POODLE attack. To help developers and security researchers identify applications that are...
CVE-2014-3694
The 1 bundled GnuTLS SSL/TLS plugin and the 2 bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and...
CVE-2014-3694
The 1 bundled GnuTLS SSL/TLS plugin and the 2 bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and...
Updated pidgin packages fix security vulnerabilities
In Pidgin before 2.10.10, both of libpurple's bundled SSL/TLS plugins one for GnuTLS and one for NSS failed to check that the Basic Constraints extension allowed intermediate certificates to act as CAs. This allowed anyone with any valid certificate to create a fake certificate for any arbitrary...
Debian DSA-3055-1 : pidgin - security update
Multiple vulnerabilities have been discovered in Pidgin, a multi-protocol instant messaging client : - CVE-2014-3694 It was discovered that the SSL/TLS plugins failed to validate the basic constraints extension in intermediate CA certificates. - CVE-2014-3695 Yves Younan and Richard Johnson...