USN-612-3: OpenVPN vulnerability

A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. As a result of this weakness, certain encryption keys are much more common than they should be, such that an attacker could guess the key through a brute-force attack given minimal knowledg...

DSA-1571-1 openssl - predictable random number generator

Bulletin has no description...

JVN#76788395 Sony mylo COM-2 does not verify server SSL certificate

Sony mylo COM-2, a mobile terminal equipped with a web browser and media palyer, contains a vulnerability where it does not verify the server certificate when connecting to a server via SSL/TLS. Impact Normally, when a client connects to a web server through a SSL/TLS connection, it would verify...

Moderate: Red Hat Security Advisory: java-1.4.2-bea security update

Updated java-1.4.2-bea packages that correct several security issues and add enhancements are now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having moderate security impact by the...

NULL pointer in SurgeFTP 2.3a2

Luigi Auriemma Application: SurgeFTP http://www.netwinsite.com/surgeftp/ Versions: = 2.3a2 Platforms: Windows, Linux and Solaris Bug: NULL pointer access Exploitation: remote Date: 25 Feb 2008 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fi...

Critical: Red Hat Security Advisory: java-1.4.2-ibm security update

Updated java-1.4.2-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. IBM's 1.4.2 SR10 Java release includes the IBM...

SuSE 10 Security Update : java-1_5_0-ibm (ZYPP Patch Number 4687)

The IBM Java JRE/SDK has been brought to release 1.5.0 SR6, containing several bugfixes, including the following security fixes : - A vulnerability in the Java Runtime Environment JRE with applet caching may allow an untrusted applet that is downloaded from a malicious website to make network...

Moderate: Red Hat Security Advisory: java-1.4.2-bea security update

Updated java-1.4.2-bea packages that correct several security issues and add enhancements are now available for Red Hat Enterprise Linux 4 Extras. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The BEA WebLogic JRockit 1.4.215 JRE and SDK...

Moderate: Red Hat Security Advisory: java-1.5.0-bea security update

Updated java-1.5.0-bea packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The BEA WebLogic JRockit 1.5.011 JRE and SDK conta...

Design/Logic Flaw

The Java Secure Socket Extension JSSE in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service via certain SSL/TLS handshake requests. NOTE: this may be...

CVE-2007-5281

The Java Secure Socket Extension JSSE in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service via certain SSL/TLS handshake requests. NOTE: this may be...

CVE-2007-5281

The Java Secure Socket Extension JSSE in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before 07-50-01, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service via certain SSL/TLS handshake requests. NOTE: this may be...

CVE-2007-5281

CVE-2007-3698 is referenced in the JSSE component that processes SSL/TLS handshake requests. In the Hitachi Cosminexus context, JSSE in Hitachi Cosminexus Developer’s Kit for Java (Cosminexus 7.5) prior to 07-50-01 is affected in environments using JSSE for SSL/TLS, allowing a remote attacker to ...

JVN#79013771 Safari allows access from HTTP to HTTPS

Safari is a default web browser installed in Mac OS X and iPhone. Safari contains a vulnerability that allows a remote attacker to access web page contents protected by SSL/TLS from an HTTP page in the same domain. Impact A remote attacker could obtain or change the web page contents protected by...

Security fix for the ALT Linux 9 package openssl10 version 0.9.8d-alt3

Aug. 7, 2007 Dmitry V. Levin 0.9.8d-alt3 - Fixed side-channel attack on private keys CVE-2007-3108, RH245732, http://cvs.openssl.org/chngview?cn=16275. - Mitigated branch prediction attacks RH250573, http://cvs.openssl.org/chngview?cn=16077. - Changed SSL/TLS server implementation to be stricter...

Security fix for the ALT Linux 9 package openssl1.1 version 0.9.8d-alt3

Aug. 7, 2007 Dmitry V. Levin 0.9.8d-alt3 - Fixed side-channel attack on private keys CVE-2007-3108, RH245732, http://cvs.openssl.org/chngview?cn=16275. - Mitigated branch prediction attacks RH250573, http://cvs.openssl.org/chngview?cn=16077. - Changed SSL/TLS server implementation to be stricter...

Design/Logic Flaw

libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions...

CVE-2007-3564

libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions...

CVE-2007-3564

libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions...

Sun JSSE SSL/TLS握手处理拒绝服务漏洞

BUGTRAQ ID: 24846 CNCAN ID:CNCAN-2007071109 Sun JSSE是一款用于应用程序中提供数据传输安全性的安全套接字扩展。 多个Java实时环境中的Sun JSSE不正确处理SSL/TLS握手请求，远程攻击者可以利用漏洞对使用JSSE支持SSL/TLS的应用程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Sun SDK Windows Production Release 1.4.2 15 Sun SDK Windows Production Release 1.4.214 Sun SDK Windows Production Release...