USN-2315-1: serf vulnerability

Ben Reser discovered that serf did not correctly handle SSL certificates with NUL bytes in the CommonName or SubjectAltNames fields. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications...

CVE-2014-5239

The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Mozilla Thunderbird < 31.0 Multiple Vulnerabilities

The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which...

Mozilla Thunderbird < 31.0 Multiple Vulnerabilities (Mac OS X)

The version of Thunderbird installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which...

Firefox < 31.0 Multiple Vulnerabilities

The version of Firefox installed on the remote host is a version prior to 31.0. It is, therefore, affected by the following vulnerabilities : - When a pair of NSSCertificate structures are added to a trust domain and then one of them is removed during use, a use-after-free error occurs which may...

Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2295-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2295-1 advisory. Christian Holler, David Keeler, Byron Campen, Gary Kwong, Jesse Ruderman, Andrew McCreight, Alon Zakai, Bobby Holley, Jonathan Watt, Shu-yu Guo, Steve...

Certificate parsing broken by non-standard character encoding — Mozilla

Mozilla security researcher Christian Holler discovered several issues while fuzzing the parsing of SSL certificates. Two of these issues were a result of using characters that are not UTF-8 in certificates when various functions expected all strings to be UTF-8 format. The third issue was a resu...

Apache 2.4.7 mod_status - Scoreboard Handling Race Condition

-- 0. Sparse summary Race condition between updating httpd's "scoreboard" and modstatus, leading to several critical scenarios like heap buffer overflow with user supplied payload and leaking heap which can leak critical memory containing htaccess credentials, ssl certificates private keys and so...

Apache Scoreboard / Status Race Condition

::: ::::::::: ::: :::::::: ::: ::::::::::::: ::: :::::::::::::::::::::::::::::::::: ::::::::: :+: :+: :+: :+: :+: :+: :+: :+::+: :+::+: :+: :+: :+: :+: :+: :+::+: :+: +:+ +:+ +:+ +:++:+ +:+ +:+ +:+ +:++:+ +:+ +:+ +:+ +:+ +:+ +:++:+ +:+ +++:++++:+++:++++++:++++:++ +++:+++++++:++ +++:++++ ++ ++...

Microsoft issues Emergency Windows Update to Block Fake SSL Certificates

Today, Microsoft has issued an emergency update for almost all versions of Windows and also for Microsoft devices running Windows Phone 8 and 8.1 to secure users from attacks that abuse the latest issued rogue SSL certificates, which could be used to impersonate Google and Yahoo! websites. A week...

Microsoft Internet Explorer Multiple Vulnerabilities (2975687)

This host is missing a critical security update according to Microsoft Bulletin MS14-037. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2014-2783

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

CVE-2014-2783: Undefined Security Weakness

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

Fedora 20 : kdelibs-4.12.5-4.fc20 (2014-7579)

Fix security issue where POP3 kioslave silently accepted invalid SSL certificates. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

CVE-2014-2001

The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate...

openSUSE Security Update : perl-libwww-perl (openSUSE-SU-2011:0552-1)

perl-libwww-perl did not verify enable host name checking of SSL certificates by default CVE-2011-0633. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update perl-libwww-perl-4589. The text...

openSUSE Security Update : postgresql (openSUSE-SU-2012:0480-1)

Security and bugfix release 9.1.3 : - Require execute permission on the trigger function for 'CREATE TRIGGER' CVE-2012-0866, bnc749299. - Remove arbitrary limitation on length of common name in SSL certificates CVE-2012-0867, bnc749301. - Convert newlines to spaces in names written in pgdump...

openSUSE Security Update : python (openSUSE-SU-2013:1440-1)

This python update includes a SSL certificates fix and other minor fixes. - disable testio completely on ppc/ppc64 - handle NULL bytes in certain fields of SSL certificates CVE-2013-4238, bnc834601, CVE-2013-4238py27.patch - python & python-base Release numbers can differ, take that into account...

openSUSE Security Update : python3 (openSUSE-SU-2013:1437-1)

This python update includes a SSL certificates fix and other minor changes. - disable testio on ppc as it hangs - handle NULL bytes in certain fields of SSL certificates CVE-2013-4238, bnc834601, CVE-2013-4238-py32.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

openSUSE Security Update : python (openSUSE-SU-2013:1438-1)

This python update includes a SSL certificates fix. - handle NULL bytes in certain fields of SSL certificates CVE-2013-4238, bnc834601, CVE-2013-4238py27.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE...