Security Bulletin: IBM Sterling Connect:Direct for UNIX CPU utilization (CVE-2014-0963)

Summary IBM Sterling Connect:Direct for UNIX is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details IBM Sterling Connect:Direct for UNIX is affected by a problem with the handling of...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows CPU utilization (CVE-2014-0963)

Summary IBM Sterling Connect:Direct for Microsoft Windows is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase. Vulnerability Details CVE ID: CVE-2014-0963 DESCRIPTION: IBM Sterling Connect:Direct for...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows CPU utilization (CVE-2014-0963)

Summary IBM Sterling Connect:Direct for Microsoft Windows is affected by a problem related to the SSL implementation which, under very specific conditions, can cause CPU utilization to rapidly increase Vulnerability Details IBM Sterling Connect:Direct for Microsoft Windows is affected by a proble...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for Microsoft Windows (CVE-2016-2177, CVE-2016-2183, CVE-2016-6306, CVE-2016-8610)

Summary OpenSSL is used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2177 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the incorrect use of...

Security Bulletin: Vulnerability in SSLv3 affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Sterling Connect:Direct for Microsoft Windows. Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attack...

Security Bulletin: Missing Cookie Attribute Vulnerability Affects IBM Secure Proxy

Summary IBM Secure Proxy has corrected the missing secure attribute in encrypted session SSL cookies from the impacted session. Vulnerability Details Third Party Entry: PSIRT-ADV0022033 DESCRIPTION: Created from Advisory: ADV0022033 CVSS Base score: 4.3 CVSS Vector:...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2016-8610)

Summary OpenSSL is used by IBM Sterling Connect:Direct for UNIX. IBM Sterling Connect:Direct for UNIX has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-8610 DESCRIPTION: SSL/TLS protocol is vulnerable to a denial of service, caused by an error when processing ALERT packets...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah Attack" for SSL/TLS affects IBM Sterling Connect:Direct for Microsoft Windows. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Sterling Connect:Direct for UNIX (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Sterling Connect:Direct for UNIX. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could...

Fedora: Security Advisory for mbedtls (FEDORA-2020-fa74e15364)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-12812

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username. Recent assessments:...

Fedora: Security Advisory for mbedtls (FEDORA-2020-5b60029fe2)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: mbedtls-2.16.7-1.fc31

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

[SECURITY] Fedora 32 Update: mbedtls-2.16.7-1.fc32

Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible. FOSS License Exception:...

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt allows a attacker to execute a type of attack known as “man-in-the-middle” attack.

The vulnerability of the Ustream-SSL library in the embedded operating system OpenWrt is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...

OSV-2020-1150 Global-buffer-overflow in ssl_sigalg

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13800 Crash type: Global-buffer-overflow READ 2 Crash state: sslsigalg ssl3getserverkeyexchange ssl3connect...

OSV-2020-920 Heap-buffer-overflow in pcpp::SSLServerHelloMessage::getSessionIDLength

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22523 Crash type: Heap-buffer-overflow READ 1 Crash state: pcpp::SSLServerHelloMessage::getSessionIDLength pcpp::SSLServerHelloMessage::SSLServerHelloMessage pcpp::SSLHandshakeMessage::createHandhakeMessage...

The vulnerability of the implementation of the VPN Secure Sockets Layer (SSL) function in the microprogramming software for Cisco Small Business RV340, Cisco Small Business RV340W, Cisco Small Business RV345, and Cisco Small Business RV345P routers allows a perpetrator to execute arbitrary code or cause service interruptions.

The vulnerability of the VPN Secure Sockets Layer SSL implementation in microprogramming software for Cisco Small Business RV340, Cisco Small Business RV340W, Cisco Small Business RV345, and Cisco Small Business RV345P routers exists due to insufficient validation of input data. Exploiting this...

openSUSE Security Update : hylafax+ (openSUSE-2020-958)

This update for hylafax+ fixes the following issues : Security issue fixed : - CVE-2020-8024 boo1172731 hylafax+ was updated to version 7.0.2 : - change FIXEDWIDTH default to better accommodate auto-rotation 13 Dec 2019 - prevent SSLaccept from blocking 5 Dec 2019 - support libtiff v4.1 5 Dec 201...

[SECURITY] Fedora 32 Update: nss-3.54.0-1.fc32

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...