[SECURITY] [DSA 1869-1] New curl packages fix SSL certificate verification weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA-1869-1 [email protected] http://www.debian.org/security/ Nico Golde August 19th, 2009 http://www.debian.org/security/faq -...

DSA-1869-1 curl - SSL certificate verification weakness

Bulletin has no description...

[ MDVSA-2009:203 ] curl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2009:203 http://www.mandriva.com/security/ Package : curl Date : August 15, 2009 Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 Problem Description: A...

Mandrake Security Advisory MDVSA-2009:198 (firefox)

The remote host is missing an update to firefox announced via advisory MDVSA-2009:198. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

curl

New curl packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue. For more information, see: http://curl.haxx.se/docs/security.html https://vulners.com/cve/CVE-2009-2417 Here are the details from the Slackware 12.2 ChangeLog:...

CURL-CVE-2009-2417 embedded zero in cert name

SSL and TLS Server certificates contain one or more fields with server name or otherwise matching patterns. These strings are stored as content and length within the certificate, and thus there is no particular terminating character. curl's OpenSSL interfacing code did faulty assumptions about...

openSUSE Security Update : fetchmail (fetchmail-1179)

This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

GnuTLS -- improper SSL certificate verification

GnuTLS reports: By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS into 1 not printing the entire CN/SAN field value when printing a certificate and 2 cause incorrect positive matches when matching a hostname against a certificate...

USN-811-1: Firefox and Xulrunner vulnerability

Juan Pablo Lopez Yacubian discovered that Firefox did not properly display invalid URLs. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. Furthermore, if the malicious website had a valid SSL...

fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2009-01: Improper SSL certificate subject verification Topics: Improper SSL certificate subject verification Author: Matthias Andree Version: 1.0 Announced: 2009-08-06 Type: Allows undetected Man-in-the-middle attacks against SSL/TLS...

[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...

DSA-1852-1 fetchmail - SSL certificate verification weakness

Bulletin has no description...

Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerability (USN-811-1)

Juan Pablo Lopez Yacubian discovered that Firefox did not properly display invalid URLs. If a user were tricked into accessing a malicious website, an attacker could exploit this to spoof the location bar, such as in a phishing attack. Furthermore, if the malicious website had a valid SSL...

Critical: Red Hat Security Advisory: nspr and nss security and bug fix update

Updated nspr and nss packages that fix security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. Netscape Portable Runtime NSPR provides platform independence for non-GUI operati...

Gizmo5 SSL Certificate Validation Security Bypass Vulnerability (Linux)

This host is installed with Gizmo5 and is prone to Security Bypass vulnerability. OpenVAS Vulnerability Test $Id: gbgizmo5sslcertisecbypassvulnlin.nasl 4869 2016-12-29 11:01:45Z teissa $ Gizmo5 SSL Certificate Validation Security Bypass Vulnerability Linux Authors: Sharath S Copyright: Copyright ...

Gizmo5 <= 3.1.0.79 SSL Certificate Validation Security Bypass Vulnerability - Linux

Gizmo5 is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-2381

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate...

Design/Logic Flaw

Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate...

CVE-2009-2381

Gizmo5 on Linux (Gizmo 3.1.0.79 and earlier) is affected by a SSL certificate validation bypass vulnerability. The root cause is that the product does not verify the server’s SSL certificate, enabling a remote server to obtain user credentials via a spoofed certificate. The CVE-2009-2381 entry is...

HP DDMI on Windows Unspecified Remote Agent Access

The remote host is running an HP Discovery & Dependency Mapping Inventory DDMI agent to facilitate communications between a central DDMI server and workstations that are part of the deployed inventory process. The version of the agent on the remote host fails to check for a valid SSL certificate...