OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

raven-ruby 'okjson_spec.rb' denial of service vulnerability

Sentry is a Python real-time logging platform built on Django. raven-ruby is a Ruby client for Sentry. A denial of service vulnerability exists in raven-ruby 'okjsonspec.rb', which can be exploited by an attacker to crash an affected application and deny service to legitimate users...

xorg-x11-server security update

1.1.1-48.107.0.1.el511 - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file 1.1.1-48.107 - CVE-2014-8091 denial of service due to unchecked malloc in client authentication 1168680 - CVE-2014-8092 integer overflow in X11 core protocol requests when calculating memory needs for...

openSUSE Security Update : chromium (openSUSE-SU-2014:1378-1)

Update to Chromium 38.0.2125.101 This update includes 159 security fixes, including 113 relatively minor fixes. Highlighted securtiy fixes are: CVE-2014-3188: A combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox CVE-2014-3189: Out-of-bounds read in PDFium...

RHEL 6 : Virtualization Manager (RHSA-2012:1537)

An updated jasperreports-server-pro package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Fedora 19 : perl-Plack-1.0031-1.fc19 (2014-9544)

---------------------------------------------------------------------- ---------- ChangeLog : - Fri Aug 8 2014 Ralf Corsepius - 1.0031-1 - Upstream update. - Thu Jan 16 2014 Ralf Corsepius - 1.0030-3 - Move misplaced %exclude-line from base-package to -Test. - Wed Jan 15 2014 Ralf Corsepius -...

Fedora 20 : xen-4.3.2-5.fc20 (2014-7423)

Fix %if line typo in the spec file, Vulnerabilities in HVM MSI injection Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

openSUSE Security Update : perl-Module-Signature (openSUSE-SU-2013:1178-1)

perl-Module-Signature was updated to 0.73, fixing bugs and security issues : Security fix for code execution in signature checking : - fix for bnc828010 CVE-2013-2145 - Properly redo the previous fix using File::Spec-filenameisabsolute. - Changes for 0.72 - Wed Jun 5 23:19:02 CST 2013 - Only allo...

openSUSE Security Update : nss-201112 (openSUSE-SU-2012:0030-1) (BEAST)

The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems. Following security issues were fixed : - SSL 2.0 is disabled by default - A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong CVE-2011-3389 is...

OpenSSL Server-Side ChangeCipherSpec Injection Scanner

This module checks for the OpenSSL ChangeCipherSpec CCS Injection vulnerability. The problem exists in the handling of early CCS messages during session negotiation. Vulnerable installations of OpenSSL accepts them, while later implementations do not. If successful, an attacker can leverage this...

OpenSSL improper handling of Change Cipher Spec message

Overview OpenSSL improperly handles Change Cipher Spec message in the initial SSL/TLS handshake. OpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM man-in-the-middle attacker to force a server and a client to use easily guessable cryptgraphic key...

DEBIAN-CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...

UBUNTU-CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...

visibility: visible undoes visibility: hidden

If you set an element to display: none the browser ignores all of its children, if a child sets itself to display: block it will remain hidden. This isn't true of visibility. Serious? Serious. html.show-only-the-button visibility: hidden; html.show-only-the-button .the-button visibility: visible;...

ShadowIRCd 6.3+ / Elemental-IRCd 6.5+ Out Of Bounds

Emergency patch for ShadowIRCd versions 6.3+ and Elemental-IRCd 6.5+ A vulnerability has been discovered in Elemental-IRCd/ShadowIRCd all the way back to version 6.3. If a client does a SASL authentication before the server is ready for it, a race condition will be met and the ircd will segfault ...

Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0752)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0752 advisory. 1.7.0.19-2.3.9.1.0.1.el59 - Add oracle-enterprise.patch - Fix DISTRONAME to Enterprise Linux 1.7.0.19-2.3.9.1.el5 - updated to updated IcedTea 2.3.9 wi...