1499 matches found
Design/Logic Flaw
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSLread due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption...
CVE-2017-15896: Undefined Security Weakness
Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSLread due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption...
Default credentials
In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, and WebSafe 12.1.0 through 12.1.2, certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel TMM. The Sessio...
SUSE-SU-2017:2688-1 Security update for MozillaFirefox, mozilla-nss
This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the following issues: This security issue was fixed for mozilla-nss: - CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating handshake hashes bsc1061005 These security issues were fixed for Firefox - CVE-2017-7825: Fixed som...
CVE-2014-2903
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...
CVE-2014-2903
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...
CVE-2014-2903: Undefined Security Weakness
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake...
EulerOS 2.0 SP1 : tigervnc (EulerOS-SA-2017-1227)
According to the versions of the tigervnc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by...
Amazon Linux AMI : tigervnc (ALAS-2017-879)
Buffer overflow in ModifiablePixelBuffer::fillRect A buffer overflow flaw, leading to memory corruption, was found in TigerVNC viewer. A remote malicious VNC server could use this flaw to crash the client vncviewer process resulting in denial of service. CVE-2017-5581 VNC server can crash when TL...
curl security, bug fix, and enhancement update
7.29.0-42 - fix use of uninitialized variable detected by Covscan 7.29.0-41 - make FTPS work with --proxytunnel 1420327 7.29.0-40 - make FTPS work with --proxytunnel 1420327 7.29.0-39 - work around race condition in PK11FindSlotByName in NSS 1404815 7.29.0-38 - make FTPS work with --proxytunnel...
F5 Networks BIG-IP : TMM SSL/TLS profile vulnerability (K21154730)
Certain values in a TLS abbreviated handshake when using a client SSL profile with the Session Ticket option enabled may cause disruption of service to the Traffic Management Microkernel TMM. The Session Ticket option is disabled by default. CVE-2017-6141 C Tenable Network Security, Inc. The...
Ubuntu 14.04 LTS : OpenJDK 7 regression (USN-3275-3)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3275-3 advisory. USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We...
USN-3275-3 openjdk-7 regression
USN-3275-2 fixed vulnerabilities in OpenJDK 7. Unfortunately, the update introduced a regression when handling TLS handshakes. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenJDK improperly re-used cached NTLM connections in...
FreeBSD : cURL -- TLS session resumption client cert bypass (again) (3e2e9b44-25ce-11e7-a175-939b30e0836d)
cURL security advisory : libcurl would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the...
tigervnc: VNC server can crash when TLS handshake terminates early
A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early...
CVE-2016-10207
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...
CVE-2016-10207
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...
CVE-2016-10207
The Xvnc server in TigerVNC allows remote attackers to cause a denial of service invalid memory access and crash by terminating a TLS handshake early...
