F5 Networks BIG-IP : TMM SSL/TLS profile vulnerability (K21154730)

Certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel TMM. The Session Ticket option is disabled by default. CVE-2017-6141 C Tenable Network Security, Inc. The...

Ubuntu 14.04 LTS : OpenJDK 7 regression (USN-3275-3)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3275-3 advisory. USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We...

USN-3275-3 openjdk-7 regression

USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenJDK improperly re-used cached NTLM connections in...

FreeBSD : cURL -- TLS session resumption client cert bypass (again) (3e2e9b44-25ce-11e7-a175-939b30e0836d)

cURL security advisory : libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the...

tigervnc: VNC server can crash when TLS handshake terminates early

A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early...

CVE-2016-10207

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

CVE-2016-10207

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

CVE-2016-10207

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

Code injection

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

CVE-2016-10207

TigerVNC Xvnc server vulnerability CVE-2016-10207 lets remote attackers terminate TLS handshakes to cause an invalid memory access and crash (DoS). Multiple Nessus/Gentoo/EulerOS/MiracleLinux advisories document the issue and reference related TigerVNC CVEs; affected products include TigerVNC Xvn...

CVE-2016-10207

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

CVE-2016-10207: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...

OpenSSL DHE and ECDHE Parameters NULL Pointer Dereference (CVE-2017-3730)

A NULL pointer dereference vulnerability exists in OpenSSL. This vulnerability is due to the way crafted DHE and ECDHE parameters are handled by an OpenSSL client application during TLS handshake. A remote attacker could exploit this vulnerability in an OpenSSL client application, by sending...

Access Bypass

OpenSSL is vulnerable to access bypass. OpenSSL accepts client authentication with a Diffie-Helman certificate without receiving a CertificateValue message. This allows attacks to gain access without the knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that...

CVE-2016-10207

A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early...

IBM WebSphere Application Server 7.0 < 7.0.0.33 Multiple Vulnerabilities

Binary data 9699.prm...

AIX 7.2 TL 0 : nettcp (IV86119) (SLOTH)

https://vulners.com/cve/CVE-2015-7575 The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message during a TLS handshake. An attacker could exploit this vulnerability using man-in-the-middle...

Vulnerability of Cisco ASA software, allowing a malicious actor to intercept sessions

The vulnerability exists in OpenSSL due to an improper limitation on the processing of ChangeCipherSpec messages. Exploiting this vulnerability allows a malicious actor to induce the use of a null-length master key in the OpenSSL-to-OpenSSL communication, thereby intercepting the session or gaini...

OpenSSL - Padding Oracle in AES-NI CBC MAC Check

Exploit for multiple platform in category dos / poc Source: http://web-in-security.blogspot.ca/2016/05/curious-padding-oracle-in-openssl-cve.html TLS-Attacker: https://github.com/RUB-NDS/TLS-Attacker https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39768.zip Y...

Amazon Linux AMI : openssl (ALAS-2016-661) (DROWN) (SLOTH)

A padding oracle flaw was found in the Secure Sockets Layer version 2.0 SSLv2 protocol. An attacker can potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is...