Mandriva Linux Security Advisory : rootcerts (MDVSA-2010:029)

The rootcerts package was added in Mandriva in 2005 and was meant to be updated when nessesary. The provided rootcerts packages has been upgraded using the latest certdata.txt file from the mozilla cvs repository, as of 2009/12/03. In Mandriva a number of additional CA root certificates has been...

openSUSE Security Update : openssl-CVE-2009-4355.patch (openssl-CVE-2009-4355.patch-1833)

Incorrect use of an openssl cleanup function can lead to memory leaks in applications. For example an ssl enabled web server such as apache that uses php, curl and openssl leaks memory if a SIGHUP signal was sent to apache. The openssl cleanup function was made more robust to avoid memory leaks...

openSUSE Security Update : libopenssl-devel (libopenssl-devel-1554)

The TLS/SSLv3 protocol as implemented in openssl prior to this update was not able to associate data to a renegotiated connection. This allowed man-in-the-middle attackers to inject HTTP requests in a HTTPS session without being noticed. For example Apache's modssl was vulnerable to this kind of...

openSUSE Security Update : libopenssl-devel (libopenssl-devel-907)

Three remote DoS vulnerabilities have been fixed in OpenSSL: a DTLS epoch record buffer memory DoS CVE-2009-1377, a DTLS fragment handling memory DoS CVE-2009-1378 and a DTLS fragment read after a free DoS CVE-2009-1379. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

openSUSE Security Update : libopenssl-devel (libopenssl-devel-974)

OpenSSL DTLS remote DoS in ChangeCipherSpec CVE-2009-1386 and in out-of-sequence message handling CVE-2009-1387 have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE Security Update : libopenssl-devel (libopenssl-devel-907)

Three remote DoS vulnerabilities have been fixed in OpenSSL: a DTLS epoch record buffer memory DoS CVE-2009-1377, a DTLS fragment handling memory DoS CVE-2009-1378 and a DTLS fragment read after a free DoS CVE-2009-1379. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text an...

Security fix for the ALT Linux 6 package freeradius version 2.1.3-1

Dec. 4, 2008 John Dennis &[email protected] - 2.1.3-1 - upgrade to latest upstream release, upstream summary follows: The focus of this release is stability. Feature Improvements: Allow running with "user=radiusd" and binding to secure sockets. Start sending Status-Server "are you alive"...

Firefox wyciwyg:// cache zone bypass

There is an interesting vulnerability in how Mozilla Firefox handles internal wyciwyg:// pseudo-URIs. These cache-related resource identifiers are meant to be inaccessible by the user - but there are at least three routes to bypass these restrictionss, one of which - HTTP 302 redirect - also...

Cisco VPN 3000 Concentrator 4.1.7/4.7.2 - 'FTP' Remote File System Access

/ Cisco VPN Concentrator 3000 FTP remote exploit ============================================== A vulnerability exists in the Cisco VPN Concentrator 3000, an unauthenticated user may access the file system through manipulation of FTP service commands. An unauthenticated user can use the following...