SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2016:2394-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

Security update for openssl (important)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 boo999665 Severity: High OCSP Status Request extension unbounded memory growth CVE-2016-6304 boo999666 Severity: Low Pointer arithmetic undefined behaviour CVE-2016-2177 boo982575 Constant time flag not...

SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

UBUNTU-CVE-2016-4763

WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Automate Incident Handling Process : IntelMQ

IntelMQ is a solution for CERTs for collecting and processing security feeds, pastebins, tweets and log files using a message queuing protocol. It’s a community driven initiative called IHAP Incident Handling Automation Project which was conceptually designed by European CERTs during several...

Two More Self-Signed Certs, Private Keys Found on Dell Machines

eDellroot is not the only self-signed trusted root certificate on Dell computers. Researchers at Duo Security found two more on a Dell Inspiron 14-inch laptop purchased by Darren Kemp, one of its researchers who is based in Calgary, Canada, including one cert related to eDellroot that also ships...

openSUSE Security Update : haproxy (openSUSE-2015-682)

haproxy was updated to fix two security issues. These security issues were fixed : - CVE-2015-3281: The bufferslowrealign function in HAProxy did not properly realign a buffer that is used for pending outgoing data, which allowed remote attackers to obtain sensitive information uninitialized memo...

DEBIAN-CVE-2015-7298

ownCloud Desktop Client before 2.0.1, when compiled with a Qt release after 5.3.x, does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which makes it easier for remote attackers to conduct man-in-the-middle MITM attacks by leveraging a server using a self-signed...

SUSE: Security Advisory for openssl-certs (SUSE-SU-2014:0025-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the OpenSUSE operating system allows malicious actors to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the openssl-certs package in the OpenSUSE operating system can lead to violations of the confidentiality, integrity, and accessibility of the protected information. This vulnerability can be exploited remotely...

Fedora 20 : libuv-0.10.34-1.fc20 / nodejs-0.10.36-3.fc20 / v8-3.14.5.10-17.fc20 (2015-2310)

nodejs - tls: re-add 1024-bit SSL certs removed by f9456a2 Chris Dickinson - timers: don't close interval timers when unrefd Julien Gilli - timers: don't mutate unref list while iterating it Julien Gilli - childprocess: check execFile args is an array Sam Roberts - childprocess: check fork args i...

Apache CloudStack Information Disclosure Vulnerability

Apache CloudStack is an open source cloud computing solution. An information disclosure vulnerability exists in Apache CloudStack, which allows remote attackers to exploit this vulnerability to obtain private keys via listSslCerts API calls...

Certificate Transparency Moves Forward With First Independent Log

The Certificate Transparency scheme proposed by Google engineers has taken a couple of significant steps forward recently, with the approval of the first independent certificate log and the passing of a deadline for all extended validation certificates to be CT-compliant or lose the green indicat...

Information disclosure

The IP Alarm aka com.cosesy.gadget.alarm application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

openSUSE Security Update : libserf / subversion (openSUSE-SU-2014:1059-1)

This subversion and libserf update fixes several security and non security issues : - subversion: guard against md5 hash collisions when finding cached credentials bnc889849 CVE-2014-3528 - subversion: raserf: properly match wildcards in SSL certs. bnc890511 CVE-2014-3522 - libserf: Handle NUL...

Cisco VPN 3000 Concentrator <= 4.1.7, 4.7.2 (FTP) Remote Exploit

No description provided by source. / Cisco VPN Concentrator 3000 FTP remote exploit ============================================== A vulnerability exists in the Cisco VPN Concentrator 3000, an unauthenticated user may access the file system through manipulation of FTP service commands. An...

SuSE 11.3 Security Update : openssl-certs (SAT Patch Number 9341)

openssl-certs has been updated to include four new and remove two certificates : - new: AtosTrustedRoot2011:2.8.92.51.203.98.44.95.179.50.crt - new: E-TugraCertificationAuthority:2.8.106.104.62.156.81.15 5.203.83.crt - new: TeliaSoneraRootCAv1:2.17.0.149.190.22.160.247.46.70.2...

Cyber Intelligence Asia 2014: CERTs and Industrial Security

In March I spoke at Cyber Intelligence Asia 2014, where CERTs from most Asians countries were presented. The fact is that only a few CERTs are now dealing in some way with industrial security, ICS and SCADA matters. One of the best of those is CERT of Japan, which is doing a great job here, and...

SuSE 11.3 Security Update : openssl-certs (SAT Patch Number 8924)

The openssl-certs package was updated to match the certificates contained in the Mozilla NSS 3.15.4 release. Following changes were done to the list of root CAs : - Added: ACCVRAIZ1.pem Spain all trusts - Added: SGTRUSTSERVICESRACINE.pem Singapore email signing only - Added: TWCAGlobalRootCA.pem...

Important: gnutls

Issue Overview: It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could ...