SuSE 11 Security Update : fetchmail (SAT Patch Number 1171)

This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

CVE-2009-3291

The phpopensslapplyverificationpolicy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates...

Code injection

The phpopensslapplyverificationpolicy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates...

CVE-2009-3291

The phpopensslapplyverificationpolicy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates...

CVE-2009-3291

CVE-2009-3291 targets PHP’s openssl verification policy. The php_openssl_apply_verification_policy function does not properly validate certificates, a flaw described as having unknown impact in the CVE entry. Multiple connected advisories (e.g., MiracleLinux AXSA:2010-78) enumerate this issue amo...

PHP < 5.2.11 Multiple Vulnerabilities

According to its banner, the version of PHP installed on the remote host is older than 5.2.11. Such versions may be affected by several security issues : - An unspecified error occurs in certificate validation inside 'phpopensslapplyverificationpolicy'. - An unspecified input validation...

php5 -- Multiple security issues

Vendor reports Security Enhancements and Fixes in PHP 5.2.11: Fixed certificate validation inside phpopensslapplyverificationpolicy. Fixed sanity check for the color index in imagecolortransparent. Added missing sanity checks around exif processing. Fixed bug 44683 popen crashes when an invalid...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : openssl vulnerability (USN-830-1)

Dan Kaminsky discovered OpenSSL would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation. Note that...

Ubuntu: Security Advisory (USN-830-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-830-1: OpenSSL vulnerability

Dan Kaminsky discovered OpenSSL would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This update handles this issue by completely disabling MD2 for certificate validation...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

FreeBSD : opera -- multiple vulnerabilities (4582948a-9716-11de-83a5-001999392805)

Opera Team Reports : - Issue where sites using revoked intermediate certificates might be shown as secure - Issue where the collapsed address bar didn't show the current domain - Issue where pages could trick users into uploading files - Some IDNA characters not correctly displaying in the addres...

CVE-2009-3046

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...

Opera < 10.00 Multiple Vulnerabilities

Binary data 5146.prm...

opera -- multiple vulnerabilities

Opera Team Reports: Issue where sites using revoked intermediate certificates might be shown as secure Issue where the collapsed address bar didn't show the current domain Issue where pages could trick users into uploading files Some IDNA characters not correctly displaying in the address bar Iss...

Debian: Security Advisory (DSA-1852-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Curl < 7.19.6 Certificate Validation Bypass Vulnerability

Binary data 5130.prm...

Curl < 7.19.6 Certificate Validation Bypass Vulnerability

Binary data 801389.prm...

SSL NULL Termination Certificate Validation Security Bypass (CVE-2009-2408; CVE-2009-2510; CVE-2009-4565)

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Firefox is a popular, open source web browser developed by Mozilla Foundation. A security bypass vulnerability has been reported in Mozilla Networ...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...