OpenSSL: Certificate verify crash with missing PSS parameter

A NULL pointer dereference flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacker could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication...

Medium: openssl

Issue Overview: A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication. CVE-2015-3194...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2015:2237-1)

This update for openssl fixes the following issues : Security fixes : - CVE-2015-3194: The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. Since these routine...

Vulnerability in OpenSSL - Certificate verify crash with missing PSS parameter

The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. Since these routines are used to verify certificate signature algorithms this can be used to crash any...

CVE-2015-6033

Qolsys IQ Panel aka QOL before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update...

The vulnerability of the Ubuntu operating system allows a hacker to use a mirror server to replace the disk images.

The vulnerability of the Simple Streams library is related to errors in the process of checking GPG signatures for disk image files. Exploiting this vulnerability allows a malicious actor, operating remotely, to use a mirrored server to replace disk images through an HTTP response with an "403"...

The vulnerability of the iOS operating system, which allows a hacker to bypass the signature verification mechanism for security checks

The vulnerability of the dyld component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the code signing verification mechanism by using a specially crafted application that embeds the signature within the...

PT-2015-2247

Name of the Vulnerable Software and Affected Versions Simple Streams simplestreams affected versions not specified Description The issue is related to the improper verification of GPG signatures of disk image files. This allows remote mirror servers to spoof disk images, potentially having other...

Medium: nss-softokn

Issue Overview: A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks. Affected Packages: nss-softokn Issue Correction: Run yum update nss-softokn...

Apple iOS Executable Program Code Signature Verification Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS Verify Code Signature. The vulnerability allows an attacker to bypass the code signature...

RHEL 6 / 7 : nss-softokn (RHSA-2015:1699)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1699 advisory. Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server...

Scientific Linux Security Update : nss on SL5.x i386/x86_64 (20150824)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward- secrecy of a TLS/SSL connection. CVE-2015-2721 A flaw was found in the way NSS...

python-oauth2: _check_signature() ignores the nonce value when validating signed urls

It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...

Design/Logic Flaw

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

CVE-2015-2964

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

PT-2015-6012

Name of the Vulnerable Software and Affected Versions NAMSHI | JOSE versions 5.0.0 and earlier Description The issue allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header. Recommendations For versions 5.0.0 and earlier, at the moment, there is...

CVE-2015-2964: Improper Input Validation

NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...

PT-2015-6312

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10.4 Description The issue arises from improper consideration of custom resource rules during app signature verification, allowing attackers to bypass intended launch restrictions by using a modified app...

CVE-2015-3714: Undefined Security Weakness

Apple OS X before 10.10.4 does not properly consider custom resource rules during app signature verification, which allows attackers to bypass intended launch restrictions via a modified app...

namshi/jose fails to verify token signatures

Overview namshi/jose is a PHP library for handling JSON Web Tokens JWT. namshi/jose contains a vulnerability in processing JWT headers where it fails to verify token signatures. Toshiharu Sugiyama of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...