The vulnerability of Trillian software allows a malicious attacker to compromise the confidentiality and integrity of protected information.

The vulnerability exists in Cerulean Studios Trillian due to the lack of verification of SSL certificates during MSN authentication. Exploiting this vulnerability allows malicious actors operating remotely to obtain MSN credentials by using a “man-in-the-middle” attack and replacing the SSL...

The vulnerability of the Internet Explorer browser allows a malicious attacker to compromise the confidentiality and integrity of protected information.

A vulnerability that allows bypassing security mechanisms exists in Internet Explorer and is related to the improper implementation of requirements for high-security SSL certificates, particularly regarding the prohibition on using group certificates. Exploiting this vulnerability enables a...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in the SSL protocol for OpenSSL due to the use of non-deterministic padding for CBC encryption block chaining of the encryption text. Exploiting this vulnerability allows a malicious actor to obtain unencrypted data by using a padding prediction attack, known as POODLE...

The vulnerability of the OpenSSL software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in OpenSSL due to the incorrect use of the “no-ssl3” option. Exploiting this vulnerability allows malicious actors to circumvent access restrictions by using SSL 3.0 negotiation. This vulnerability is related to the s23clnt.c and s23srvr.c files...

The vulnerability of the Linux operating system, which allows a malicious individual to trigger a service failure

A local user can trigger a service failure when using the RDS network protocol through Infiniband channels...

Sushiro App fails to verify SSL server certificates

Overview Sushiro App provided by AKINDO SUSHIRO CO., LTD. fails to verify SSL server certificates. Yuta Teshima of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

SUSE-SU-2016:1640-1 Security update for ctdb

ctdb was updated to fix one security issue. This security issue was fixed: - bsc969522: ctdb opening sockets with htonsIPPROTORAW...

SUSE-SU-2016:1639-1 Security update for libimobiledevice, usbmuxd

libimobiledevice, usbmuxd were updated to fix one security issue. This security issue was fixed: - CVE-2016-5104: Sockets listening on INADDRANY instead of only locally 982014...

DEBIAN-CVE-2016-2177

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and application crash or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3srvr....

openSUSE Security Update : nodejs (openSUSE-2016-715)

This update for nodejs to version 4.4.5 fixes the several issues. These security issues introduced by the bundled openssl were fixed by going to version 1.0.2h : - CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider memory allocation during a certain padding check, which allowed...

The vulnerability of the Mac OS X operating system, which allows a perpetrator to obtain confidential information

The vulnerability of the Tcl component in the Mac OS X operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to obtain confidential information by using SSLv2 support...

Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-03941)

F5 BIG-IP Analytics and others are products of F5 Corporation in the U.S. F5 BIG-IP Analytics is a suite of Web application performance analytics software. the APM is a suite of solutions that provide secure and unified access to business-critical applications and networks. and the LTM is a local...

Man-in-the-middle attack vulnerabilities in multiple DMM products

DMM FX Trade for Android and others are Android-based applications developed by DMM Securities Inc. of Japan for foreign exchange trade transactions. A security vulnerability exists in several DMM products, which stems from the program's failure to validate SSL server certificates. An attacker...

OracleVM 3.3 : kernel-uek (OVMSA-2016-0053)

The remote OracleVM system is missing necessary patches to address critical security updates : - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. David Howells Orabug: 23279020 CVE-2016-0758 - net: add validation for the socket syscall protocol argument Hannes Frederic...

UBUNTU-CVE-2016-4951

The tipcnlpubldump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a dumpit operation...

Red Hat OpenShift Enterprise STI build process elevation of privilege vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. The STI build process in Red Hat OpenShift Enterprise fails to properly restrict access to the STI...

CVE-2016-1853

Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support...

THE HYAKUGO BANK 105 BANK Man-in-the-Middle Attack Vulnerability

THE HYAKUGO BANK 105 BANK is a suite of online banking mobile apps from THE HYAKUGO BANK, Japan. A man-in-the-middle attack vulnerability exists in THE HYAKUGO BANK 105 BANK, which arises from the program failing to properly validate an SSL server certificate. An attacker could use this...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3559)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3559 advisory. - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. David Howells Orabug: 23279022 CVE-2016-0758 - unix: properly account...

openssl security update

CentOS Errata and Security Advisory CESA-2016:0996 An update for openssl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...