stunnel < 5.12 OpenSSL Multiple Vulnerabilities

The version of stunnel installed on the remote host is prior to version 5.12. It is, therefore, affected by the following vulnerabilities in the bundled OpenSSL library : - A flaw exists in the DTLSv1listen function due to state information being preserved in the SSL object from one invocation to...

CVE-2015-0252

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service segmentation fault and crash via crafted XML data...

CVE-2015-0252

internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service segmentation fault and crash via crafted XML data...

GLSA-201503-11 : OpenSSL: Multiple vulnerabilities (FREAK)

The remote host is affected by the vulnerability described in GLSA-201503-11 OpenSSL: Multiple vulnerabilities Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers and the upstream advisory referenced below for details: RSA silently downgrades to EXPORTRSA Client...

SuSE 11.3 Security Update : OpenSSL (SAT Patch Number 10481)

OpenSSL has been updated to fix various security issues : - A Use After Free following d2iECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys. CVE-2015-0209 - A segmentation faul...

Debian DSA-3199-1 : xerces-c - security update

Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c, a validating XML parser library for C++. The parser mishandles certain kinds of malformed input documents, resulting in a segmentation...

openSUSE Security Update : openssl (openSUSE-2015-247)

OpenSSL was updated to fix various security issues. Following security issues were fixed : - CVE-2015-0209: A Use After Free following d2iECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client...

Xerces-C Security Advisory [CVE-2015-0252]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Xerces-C XML Parser library versions prior to V3.1.2 Description: The Xerces-C XML parser...

xerces-c: denial of service

CVE-2015-0252 denial of service The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in a segmentation fault during a parse operation. The bug does not appear to allow for remote code execution, but is a denial of service attack that in many applications may...

DSA-3199-1 xerces-c - security update

Bulletin has no description...

FreeBSD : OpenSSL -- multiple vulnerabilities (9d15355b-ce7c-11e4-9db0-d050992ecde8) (FREAK)

OpenSSL project reports : - Reclassified: RSA silently downgrades to EXPORTRSA Client CVE-2015-0204. OpenSSL only. - Segmentation fault in ASN1TYPEcmp CVE-2015-0286 - ASN.1 structure reuse memory corruption CVE-2015-0287 - PKCS7 NULL pointer dereferences CVE-2015-0289 - Base64 decode CVE-2015-029...

Vulnerability in OpenSSL - Segmentation fault for invalid PSS parameters

Segmentation fault for invalid PSS parameters. The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can ...

Vulnerability in OpenSSL - Multiblock corrupted pointer

Multiblock corrupted pointer. OpenSSL 1.0.2 introduced the “multiblock” performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of “multiblock” can cause OpenSSL’s internal write buffer to become...

Vulnerability in OpenSSL - Segmentation fault in ASN1_TYPE_cmp

Segmentation fault in ASN1TYPEcmp. The function ASN1TYPEcmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1TYPEcmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and...

Vulnerability in OpenSSL - Base64 decode

A vulnerability existed in previous versions of OpenSSL related to the processing of base64 encoded data. Any code path that reads base64 data from an untrusted source could be affected such as the PEM processing routines. Maliciously crafted base 64 data could trigger a segmenation fault or memo...

Vulnerability in OpenSSL - Segmentation fault in DTLSv1_listen

Segmentation fault in DTLSv1listen. A defect in the implementation of DTLSv1listen means that state is preserved in the SSL object from one invocation to the next that can lead to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an erro...

OpenSSL -- multiple vulnerabilities

OpenSSL project reports: Reclassified: RSA silently downgrades to EXPORTRSA Client CVE-2015-0204. OpenSSL only. Segmentation fault in ASN1TYPEcmp CVE-2015-0286 ASN.1 structure reuse memory corruption CVE-2015-0287 PKCS7 NULL pointer dereferences CVE-2015-0289 Base64 decode CVE-2015-0292. OpenSSL...

OpenSSL: Multiple vulnerabilities

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers and the upstream...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2015:0327 Updated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS bas...

Moderate: Red Hat Security Advisory: glibc security and bug fix update

Updated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...