DSA-3254-1 suricata - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3254-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Symantec Web Security Gateway Detection via SSL/TLS

Binary data 8755.prm...

Lenovo System Update Vulnerabilities Patched

Still reeling from the Superfish vulnerability, three more serious vulnerabilities have been patched and disclosed in Lenovo’s update system for its PCs. Researchers at IOActive yesterday disclosed details on a trio of security issues related to the mechanism by which Lenovo machines are sent...

suricata -- TLS/DER Parser Bug (DoS)

OISF Development Team reports: The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series. The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported b...

Facebook Opens Free Internet to Developers, But won't Support HTTPS Encryption

After facing much criticism for violation of Net Neutrality, Facebook has opened up its new Internet.org platform to developers for creating their apps and services in India and other countries. Facebook's Internet.org aims at offering free Internet access to "the next 5 billion" impoverished...

Fedora 22 : dovecot-2.2.16-2.fc22 (2015-7156)

fixes CVE-2015-3420: SSL/TLS handshake failures leading to a crash of the login process - dovecot updated to 2.2.16 - auth: Don't crash if master user login is attempted without any configured master=yes passdbs - Parsing UTF-8 text for mails could have caused broken results sometimes if bufferin...

MySQL SSL/TLS connection there is a security vulnerability, by the man in the middle attacks-vulnerability warning-the black bar safety net

Due to the client in the connection to MySQL when the SSL options are used improperly, may cause middle attack. The vulnerability will cause the database to the communication data in plaintext form in the network transmission. Vulnerability details This vulnerability with the client”–ssl”option h...

VMware vSphere Update Manager Java Vulnerability (VMSA-2015-0003)

The version of VMware vSphere Update Manager installed on the remote Windows host is 5.0 prior to Update 3d, 5.1 prior to Update 3a, 5.5 prior to Update 2e, or 6.0 prior to 6.0.0a. It is, therefore, affected by a vulnerability related to the bundled version of Oracle JRE prior to 1.7.076. A flaw...

New MySQL Bug Can Strip SSL Protection From Connections

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently. The vulnerability is the result of the way that an option in MySQL handles requests for secure...

dovecot: denial of service

Dovecot = 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL most likely = 1.0.2. A patch to OpenSSL has also been written to handle more...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

Red Hat JBoss BRMS 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

PT-2015-1089

Name of the Vulnerable Software and Affected Versions Java SE version 8u40 Oracle Java SE versions prior to 8u40 are not explicitly mentioned, but based on the information given, it can be inferred that versions prior to 8u40 may be affected. Description The issue allows a remote attacker to...

PT-2015-1083

Name of the Vulnerable Software and Affected Versions Java SE versions 5.0u81, 6u91, 7u76, and 8u40 Java FX version 2.2.76 Description The issue allows a remote attacker to compromise the confidentiality, integrity, and availability of data using the 2D component. It affects the security of SSL/T...

Juniper Junos QFX Low Entropy Vulnerability (JSA10678)

According to its self-reported version number, the remote Juniper Junos device is affected by a low entropy vulnerability due to an insufficient number of bytes being collected from the RANDOMINTERRUPT entropy source when the device is first booted, thus resulting in the generation of weak SSH ke...

PT-2015-1091

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40 IBM SSL/TLS implementations affected versions not specified Description The issue affects the integrity of data and is related to the Beans component in Oracle Java SE, allowing remote...

PT-2015-1088

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40 IBM SSL/TLS implementations affected versions not specified Description The issue allows remote attackers to affect the integrity and availability of data. It is related to the Tools compone...

PT-2015-1093

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40 JRockit version R28.3.5 Description The issue allows a remote attacker to affect confidentiality via vectors related to the JCE component. It could also allow a remote attacker to downgrade...

PT-2015-1081

Name of the Vulnerable Software and Affected Versions Java SE versions 5.0u81, 6u91, 7u76, and 8u40 Description The issue allows a remote attacker to compromise the confidentiality, integrity, and availability of data using the 2D component. It affects the security of SSL/TLS connections,...

PT-2015-1090

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40 JRockit version R28.3.5 Description The issue allows remote attackers to affect availability via vectors related to JSSE, potentially disrupting data access. It is also related to a...