Design/Logic Flaw

yum-rhn-plugin in Red Hat Enterprise Linux RHEL 5 does not verify the SSL certificate for a file download from a Red Hat Network RHN server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service loss of updates or force the download and installation of official...

CVE-2008-3270

yum-rhn-plugin in Red Hat Enterprise Linux RHEL 5 does not verify the SSL certificate for a file download from a Red Hat Network RHN server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service loss of updates or force the download and installation of official...

CVE-2008-3270

CVE-2008-3270 affects yum-rhn-plugin on Red Hat Enterprise Linux 5. The root cause is that the plugin fails to verify the SSL certificate when contacting the Red Hat Network, enabling a man-in-the-middle to potentially cause a denial of service (loss of updates) or force installation of unrequest...

CVE-2008-3270

yum-rhn-plugin in Red Hat Enterprise Linux RHEL 5 does not verify the SSL certificate for a file download from a Red Hat Network RHN server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service loss of updates or force the download and installation of official...

RHEL 5 : yum-rhn-plugin (RHSA-2008:0815)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2008:0815 advisory. The yum-rhn-plugin provides support for yum to securely access a Red Hat Network RHN server for software updates. It was discovered that yum-rhn-plug...

Moderate: Red Hat Security Advisory: yum-rhn-plugin security update

Updated yum-rhn-plugin packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The yum-rhn-plugin provides support for yum to securely access a Red Hat Network RHN...

Code injection

The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM...

CVE-2008-3249

The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM...

acroread: insecure handling of temporary files

acroread in Adobe Acrobat Reader 8.1.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files related to SSL certificate handling...

Code injection

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also...

CVE-2008-2809

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also...

CVE-2008-2809

This CVE (CVE-2008-2809) describes a flaw in Mozilla-based browsers where, if a user accepts an SSL server certificate based on the CN in the DN, that certificate is also accepted for all names listed in subjectAltName:dNSName. Affected products include Mozilla 1.9 M8 and earlier, Firefox 2 befor...

Firefox self signed certificate flaw

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also...

ThinkVantage System Update < 3.14 SSL Certificate Issuer Spoofing

The remote host is running ThinkVantage System Update, a software distribution tool for Lenovo computers. The version of System Update installed on the remote host reportedly does not perform certificate chain verification when initiating an SSL connection with an update server. An attacker who...

SSL Certificate Information

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate. TRUSTED...

[SECURITY] [DSA 1534-2] New iceape packages fix regression

------------------------------------------------------------------------ Debian Security Advisory DSA-1534-2 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff April 24, 2008 http://www.debian.org/security/faq -...

Mozilla Thunderbird/Seamonkey/Firefox 2.0.0.13版本修复多个安全漏洞

BUGTRAQ ID: 28448 CVECAN ID: CVE-2008-1241,CVE-2008-1240,CVE-2007-4879,CVE-2008-1238,CVE-2008-1236,CVE-2008-1237,CVE-2008-1233,CVE-2008-1234,CVE-2008-1235 Firefox/Thunderbird/SeaMonkey是Mozilla所发布的WEB浏览器和邮件/新闻组客户端。...

[SECURITY] [DSA 1532-1] New xulrunner packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1532-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 27, 2008 http://www.debian.org/security/faq -...

[ GLSA 200803-30 ] ssl-cert eclass: Certificate disclosure

Gentoo Linux Security Advisory GLSA 200803-30 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Fedora 7 : ruby-1.8.6.114-1.fc7 (2008-2458)

Tue Mar 4 2008 Akira TAGOH - 1.8.6.114-1 - Security fix for CVE-2008-1145. - Improve a spec file. 226381 - Correct License tag. - Fix a timestamp issue. - Own a arch-specific directory. - Tue Feb 19 2008 Fedora Release Engineering - 1.8.6.111-9 - Autorebuild for GCC 4.3 - Tue Feb 19 2008 Akira...