99 matches found
The vulnerability of the SSL_check_chain function in the TLS protocol implementation of the OpenSSL library involves the possibility of reassigning the null pointer due to incorrect processing of the “signature_algorithms_cert” extension in TLS. This allows a perpetrator to cause a service failure.
The vulnerability of the SSLcheckchain function in the TLS protocol implementation of the OpenSSL library is related to the possibility of replacing the zero pointer due to incorrect processing of the “signaturealgorithmscert” extension in TLS. Exploiting this vulnerability can allow a malicious...
DEBIAN-CVE-2020-1967
Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...
ALPINE-CVE-2020-1967
Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...
PT-2020-2778
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1d through 1.1.1f MySQL Server versions 5.6.48 and earlier, 5.7.30 and earlier, 8.0.20 and earlier Description The issue is related to the incorrect handling of the "signature algorithms cert" TLS extension, which can caus...
Segmentation fault in SSL_check_chain
Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the “signaturealgorithmscert” TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...
OpenSSL remote denial of service vulnerability
Problem Description: Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognized...
UBUNTU-CVE-2020-1967
Server or client applications that call the SSLcheckchain function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signaturealgorithmscert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm i...
DEBIAN-CVE-2015-0294
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate...
CVE-2015-0294: Improper Certificate Validation
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate...
PT-2018-3641
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1j MySQL Server versions 5.7.33 and earlier, 8.0.23 and earlier Description The issue is related to a NULL pointer dereference in OpenSSL TLS servers when a maliciously crafted renegotiation ClientHello messa...
CVE-2017-5872
The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service network connectivity disruption via a client hello with a...
Design/Logic Flaw
The TCP/IP networking module in Unisys ClearPath MCP systems with TCP-IP-SW 57.1 before 57.152, 58.1 before 58.142, or 59.1 before 59.172, when running a TLS 1.2 service, allows remote attackers to cause a denial of service network connectivity disruption via a client hello with a...
PT-2017-16724
Name of the Vulnerable Software and Affected Versions Unisys ClearPath MCP systems with TCP-IP-SW versions 57.1 through 57.151 Unisys ClearPath MCP systems with TCP-IP-SW versions 58.1 through 58.141 Unisys ClearPath MCP systems with TCP-IP-SW versions 59.1 through 59.171 Description The issue...
Denial Of Service (DoS) Through Null Pointer Dereference
OpenSSL is vulnerable to denial of service DoS attacks. These attacks can be triggered by using an invalid signaturealgorithms extension in the the ClientHello message during renegotiation...
openSUSE Security Update : Mozilla Firefox / Thunderbird and NSS (openSUSE-2016-1407)
This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2 fixes a number of security issues. The following vulnerabilities were fixed in Mozilla Firefox MFSA 2016-89 : - CVE-2016-5296: Heap-buffer-overflow WRITE in rasterizeedges1 bmo1292443 - CVE-2016-5292: URL parsing causes cras...
CVE-2016-0923
The client in EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server...
RUSTSEC-2016-0005 rust-crypto is unmaintained; switch to a modern alternative
The rust-crypto crate has not seen a release or GitHub commit since 2016, and its author is unresponsive. NOTE: The old rust-crypto crate with hyphen should not be confused with similarly named new RustCrypto GitHub Org without hyphen. The GitHub Org is actively maintained. We recommend you switc...
Updated botan packages fix security vulnerabilities
Updated botan packages fix security vulnerabilities: During RSA decryption, how long decoding of PKCS 1 v1.5 padding took was input dependent. If these differences could be measured by an attacker, it could be used to mount a Bleichenbacher million-message attack CVE-2015-7827. ECDSA and DSA...
