4174 matches found
CVE-2009-2943
The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings...
CVE-2009-2942
CVE-2009-2942 affects mysql-ocaml bindings for MySQL (OCaml bindings) up to version 1.0.4, where mysql_real_escape_string is not properly supported. The root cause is missing proper escaping for multibyte character encodings, which can lead to escaping issues when handling multibyte sequences. De...
CVE-2009-2943
The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings...
CVE-2009-2940
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings...
CVE-2009-2940
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings...
GLSA-200910-01 : Wget: Certificate validation error
The remote host is affected by the vulnerability described in GLSA-200910-01 Wget: Certificate validation error The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character. Specifically, the processing of such fields is...
Wget: Certificate validation error
Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character...
Debian: Security Advisory (DSA-1909-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
DSA-1910-1 mysql-ocaml - missing escape function
Bulletin has no description...
DSA-1909-1 postgresql-ocaml - missing escape function
Bulletin has no description...
wget certificate spoofing
It's possible to spoof ceritificate by using NULL character in the Common Name...
SSL Certificate Null Character Spoofing Weakness
The remote host contains an SSL certificate with a common name containing a Null character \x00 in it. This may indicate a compromise or that a program such as SSLsniff is spoofing the certificate in order to intercept the traffic via a Man-in-The-Middle MiTM attack. Certificates with such...
DEBIAN-CVE-2009-3490
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...
[SECURITY] [DSA 1896-1] New Shibboleth 1.x packages fix potential code execution
------------------------------------------------------------------------ Debian Security Advisory DSA-1896-1 [email protected] http://www.debian.org/security/ Florian Weimer September 28, 2009 http://www.debian.org/security/faq -...
Fedora 10 : gnutls-2.4.2-5.fc10 (2009-8622)
This update fixes handling of NUL characters in certificate Common Name or subjectAltName fields especially in regards to comparsion to hostnames. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...
cURL: Certificate validation error
Background cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. Description Scott Cantor reported that cURL does not properly handle fields in X.509 certificates that contain an ASCII NUL \0 character. Specifically, the processing of such fields is...
SuSE 10 Security Update : OpenLDAP2 (ZYPP Patch Number 6485)
This update of openldap2 makes SSL certificate verification more robust against uses of the special character \0 in the subjects name. CVE-2009-2408 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...
Google + reCAPTCHA Could Raise Bar in Anti-Bot, Anti-Spam Fight
Locked in a cat-and-mouse game with spammers who use bots to defeat anti-fraud mechanisms and create fake accounts, Google today announced a deal to acquire reCAPTCHA, a company that provides those squiggly words at login screens. The ReCAPTCHA deal isn’t exactly a security transaction...
