CVE-2015-0799

The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header...

CVE-2015-0799

Summary: Mozilla Firefox before 37.0.1 is affected by CVE-2015-0799 due to the HTTP Alt-Svc feature, which allows a man‑in‑the‑middle attacker to bypass X.509 certificate verification by directing the client to a chosen server via the uri-host in an Alt-Svc header. Impact: potential MITM disclosu...

Ubuntu 14.04 LTS : Firefox vulnerability (USN-2557-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2557-1 advisory. Muneaki Nishimura discovered a flaw in Mozilla's HTTP Alternative Services implementation which meant SSL certificate verification could be bypassed in some...

Vulnerability Forces Mozilla to Disable Opportunistic Encryption in Firefox

Less than a week after introducing the new opportunistic encryption feature in Firefox, Mozilla has had to disable it because of a security vulnerability in the browser’s implementation of the HTTP Alternative Services specification. The bug puts a kink in the new feature, which was designed to...

USN-2557-1 firefox vulnerability

Muneaki Nishimura discovered a flaw in Mozilla's HTTP Alternative Services implementation which meant SSL certificate verification could be bypassed in some circumstances. A remote attacker could potentially exploit this to conduct a machine-in-the-middle attack. CVE-2015-0799...

USN-2557-1: Firefox vulnerability

Muneaki Nishimura discovered a flaw in Mozilla's HTTP Alternative Services implementation which meant SSL certificate verification could be bypassed in some circumstances. A remote attacker could potentially exploit this to conduct a machine-in-the-middle attack. CVE-2015-0799...

CVE-2015-0799

The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header...

firefox: certificate verification bypass

Security researcher Muneaki Nishimura discovered a flaw in the Mozilla's HTTP Alternative Services implementation. If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SS...

Certificate verification bypass through the HTTP/2 Alt-Svc header — Mozilla

Security researcher Muneaki Nishimura discovered a flaw in the Mozilla's HTTP Alternative Services implementation. If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SS...

SSL/TLS: Hostname discovery from server certificate

It was possible to discover an additional hostname of this server from its certificate Common or Subject Alt Name. Copyright C 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Komodia Certificate Manipulation Enabled Man-In-The-Middle Attacks

The shoddy state of SSL certificate validation on the Internet again floated to the surface, this time by the Superfish mess, which continues to get worse. The Electronic Frontier Foundation on Wednesday released a report based on data scoured from the Decentralized SSL Observatory which it...

RedStar-3.0-Desktop-SUDO

Alternative steps: https://pbs.twimg.com/media/B68inqBIQAA5sK6.png Proof: https://github.com/HackerFantastic/Public/blob/master/exploits/redstar3.0-localroot.png...

OracleVM 3.3 : wget (OVMSA-2014-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2014-4877 wget: FTP symlink arbitrary filesystem access 1156133 - Fix the parsing of weblink when doing recursive retrieving 960137 - Fix errors found by static analysis of source code 873216 ...

Gogs Markdown Renderer Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 XSS in Gogs Markdown Renderer ============================= Researcher: Timo Schmid Description =========== GogsGo Git Service is a painless self-hosted Git Service written in Go. taken from 1 It is very similiar to the github hosting plattform...

American Express Brings Tokenization to Payment Cards

American Express has taken steps toward lifting the burden from retailers having to store payment-card data with the announcement of its American Express Token Service. The service will replace traditional 16-digit credit card numbers with a digital token. Consumers carrying a card supporting the...

Google Launches User-Friendly 'Inbox' App, Alternative To Gmail

Google is offering its users a completely new and better experience of its mailing service. And in an effort to do this, the company has launched a new email service, an alternative to Gmail, called "Inbox" on Wednesday that aims to make email more useful and preview next-generation capabilities...

The Bash Vulnerability: How to Protect your Environment

A recently discovered hole in the security of the Bourne-Again Shell bash has the majority of Unix/Linux including OS X admins sweating bullets. You should be, too--attackers have already developed exploits to unleash on unpatched web servers, network services and daemons that use shell scripts...

CVE-2014-7382

The CVE-2014-7382 entry describes a vulnerability in The Alternative Connection (com.wAlternativeConnection) app version 0.1 for Android where SSL X.509 certificates are not verified. This allows man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via a craft...

[SECURITY] Fedora 20 Update: mksh-50c-1.fc20

mksh is the MirBSD enhanced version of the Public Domain Korn shell pdksh, a bourne-compatible shell which is largely similar to the original AT&T Korn shell. It includes bug fixes and feature improvements in order to produce a modern, robust shell good for interactive and especially script use,...

[SECURITY] Fedora 21 Update: mksh-50c-1.fc21

mksh is the MirBSD enhanced version of the Public Domain Korn shell pdksh, a bourne-compatible shell which is largely similar to the original AT&T Korn shell. It includes bug fixes and feature improvements in order to produce a modern, robust shell good for interactive and especially script use,...