TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to...

RedHat Update for nss RHSA-2016:0007-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-4941

IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service MQXR service crash via unspecified vectors...

CVE-2015-4941

IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service MQXR service crash via unspecified vectors...

CVE-2015-4941: Undefined Security Weakness

IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service MQXR service crash via unspecified vectors...

curl security, bug fix, and enhancement update

7.29.0-25.0.1 - disable check to make build pass 7.29.0-25 - fix spurious failure of test 1500 on ppc64le 1218272 7.29.0-24 - use the default min/max TLS version provided by NSS 1170339 - improve handling of timeouts and blocking direction to speed up FTP 1218272 7.29.0-23 - require credentials t...

FreeBSD : LibreSSL -- Memory leak and buffer overflow (e75a96df-73ca-11e5-9b45-b499baebfeaf)

Qualys reports : During the code review of OpenSMTPD a memory leak and buffer overflow an off-by-one, usually stack-based were discovered in LibreSSL's OBJobj2txt function. This function is called automatically during a TLS handshake both client-side, unless an anonymous mode is used, and...

LibreSSL -- Memory leak and buffer overflow

Qualys reports: During the code review of OpenSMTPD a memory leak and buffer overflow an off-by-one, usually stack-based were discovered in LibreSSL's OBJobj2txt function. This function is called automatically during a TLS handshake both client-side, unless an anonymous mode is used, and...

CVE-2015-5887

The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data...

Design/Logic Flaw

The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data...

CVE-2015-5887

CVE-2015-5887 affects Apple macOS Secure Transport: the TLS Handshake Protocol in OS X before 10.11 accepts a CertificateRequest within a session that did not send ServerKeyExchange. This allows remote attackers to influence the TLS negotiation via crafted data, with an unspecified impact. The is...

PT-2015-2285

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.11 Description The issue is related to the TLS Handshake Protocol implementation in Secure Transport, which accepts a Certificate Request message within a session where no Server Key Exchange message has been...

CVE-2015-5887: Undefined Security Weakness

The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request message within a session in which no Server Key Exchange message has been sent, which allows remote attackers to have an unspecified impact via crafted TLS data...

CVE-2015-5369

Pulse Connect Secure aka PCS and formerly Juniper PCS PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished T...

Dovecot imap-login TLS Handshake Denial of Service Vulnerability

Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . A denial of service vulnerability exists in Dovecot version 2.2.16 and earlier. Due to an imap-login related error in the program's handling of forced SSLv3 connections. An attacker can exploit the vulnerabilit...

Mandriva Linux Security Advisory : dovecot (MDVSA-2015:113)

Updated dovecot packages fix security vulnerability. Dovecot before 2.2.13 is vulnerable to a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly...

Exploit for Out-of-bounds Read in Openssl

Heartbleed PoC =========== A sample example of the Heartbleed...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

jdk7-openjdk: multiple issues

CVE-2014-3566 man-in-the-middle Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6585 out-of-bounds read Allows remote attackers to affect confidentiality via font parsing...