Mandriva Linux Security Advisory : qt4 (MDVSA-2009:225)

A vulnerability has been found and corrected in qt4 : src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

RedHat Security Advisory RHSA-2009:1427

The remote host is missing updates announced in advisory RHSA-2009:1427. Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections. It was discovered that fetchmail is affected by the previously published null prefix...

RedHat Security Advisory RHSA-2009:1427

The remote host is missing updates announced in advisory RHSA-2009:1427. Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections. It was discovered that fetchmail is affected by the previously published null prefix...

RHEL 3 / 4 / 5 : fetchmail (RHSA-2009:1427)

An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility intended for...

openSUSE Security Update : perl-IO-Socket-SSL (perl-IO-Socket-SSL-1264)

This update of perl-IO-Socket-SSL improves the hostname checking of the SSL certificate. CVE-2009-3024 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update perl-IO-Socket-SSL-1264. The text...

fetchmail security update

CentOS Errata and Security Advisory CESA-2009:1427 An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote...

Moderate: Red Hat Security Advisory: fetchmail security update

An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility intended for...

CVE-2009-2700

src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

CVE-2009-3046

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...

CVE-2009-2700

src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

Debian: Security Advisory (DSA-1873-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 1873-1] New xulrunner packages fix spoofing vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1873-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 26, 2009 http://www.debian.org/security/faq -...

DSA-1873-1 xulrunner - spoofing vulnerabilities

Bulletin has no description...

CVE-2009-2474

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

openSUSE Security Update : MozillaFirefox (MozillaFirefox-1202)

MozillaFirefox was updated to the 3.0.13 release, fixing some security issues and bugs : MFSA 2009-44 / CVE-2009-2654: Security researcher Juan Pablo Lopez Yacubian reported that an attacker could call window.open on an invalid URL which looks similar to a legitimate URL and then use document.wri...

openSUSE Security Update : libfreebl3 (libfreebl3-1201)

The Mozilla NSS security framework was updated to version 3.12.3.1. CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant...

openSUSE Security Update : wget (wget-1198)

This update wget improves the handling of the 0-character in the subject name of a SSL certificate. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update wget-1198. The text description of this plug...

FreeBSD : GnuTLS -- improper SSL certificate verification (856a6f84-8b30-11de-8062-00e0815b8da8)

GnuTLS reports : By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS into 1 not printing the entire CN/SAN field value when printing a certificate and 2 cause incorrect positive matches when matching a hostname against a certificate. %NASLMINLEVEL 70300 C Tenable Network Security...

openSUSE Security Update : wget (wget-1198)

This update wget improves the handling of the 0-character in the subject name of a SSL certificate. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update wget-1198. The text description of this plug...

openSUSE Security Update : curl (curl-1180)

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. CVE-2009-2417 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...