SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:1042-1)

This update for curl fixes the following issues: Security issue fixed : - CVE-2016-9586: libcurl printf floating point buffer overflow bsc1015332 - CVE-2017-7407: The ourWriteOut function in toolwriteout.c in curl might have allowed physically proximate attackers to obtain sensitive information...

SUSE-SU-2017:1042-1 Security update for curl

This update for curl fixes the following issues: Security issue fixed: - CVE-2016-9586: libcurl printf floating point buffer overflow bsc1015332 - CVE-2017-7407: The ourWriteOut function in toolwriteout.c in curl might have allowed physically proximate attackers to obtain sensitive information fr...

SUSE-SU-2017:0720-1 Security update for java-1_7_1-ibm

This update for java-171-ibm fixes the following issues: Security issue fixed: - CVE-2016-2183: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remo...

USN-3198-1: OpenJDK 6 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

Ubuntu: Security Advisory (USN-3194-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3194-1 openjdk-7 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

USN-3194-1: OpenJDK 7 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

USN-3179-1: OpenJDK 8 vulnerabilities

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes...

SA133 : Sweet32 Birthday Attack against DES, 3DES, and Blowfish

SUMMARY Symantec Network ProtectionSy products that use the DES, 3DES, and Blowfish symmetric encryption ciphers in long-lived encrypted SSL/TLS, SSH, or VPN connections are susceptible to the Sweet32 birthday attack. A remote attacker with the ability to observe a long-lived encrypted connection...

Data Exfiltration In Plain Sight: Cloakify Toolset

Data Exfiltration In Plain Sight -Cloakify Toolset Evade DLP/MLS Devices; Social Engineering of Analysts; Evade AV Detection CloakifyFactory transforms any filetype e.g. .zip, .exe, .xls, etc. into a list of harmless-looking strings. This lets you hide the file in plain sight, and transfer the fi...

Extreme ExtremeXOS OpenSSL Vulnerability (VN-2016-002)

Extreme ExtremeXOS is prone to an OpenSSL vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:extremenetworks:exos"; i...

SUSE-SU-2016:2871-1 Security update for libtcnative-1-0

This update for libtcnative-1-0 fixes the following issues: - Upgrade to libtcnative-1.1.34 bugfix release bsc1004455 See https://tomcat.apache.org/native-1.1-doc/miscellaneous/changelog.html Unconditionally disable export Ciphers. Improve ephemeral key handling for DH and ECDH. Parameter strengt...

LocalTapiola: Poodle attack SSLv3 Support (viestinta.lahitapiola.fi)

Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network attacker to extract the plaintext of targeted parts of an SSL connection, usually cookie dat...

Oracle Linux 7 : mod_nss (ELSA-2016-2602)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-2602 advisory. - OpenSSL ciphers stopped parsing at +, CVE-2016-3099 1323913 Tenable has extracted the preceding description block directly from the Oracle Linux security...

mod_nss security, bug fix, and enhancement update

1.0.14-7 - Add the permission patch to the repository 1312583 1.0.14-6 - Check the NSS certificate database directory for read permissions by the Apache user. 1312583 1.0.14-5 - Update clean semaphore patch to not free the pinList twice. 1364560 1.0.14-4 - Update clean semaphore patch to not clos...

mod_nss: Invalid handling of +CIPHER operator

A flaw was found in the way modnss parsed certain OpenSSL-style cipher strings. As a result, modnss could potentially use ciphers that were not intended to be enabled...

Amazon Linux: Security Advisory (ALAS-2016-750)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OracleVM 3.2 : openssl (OVMSA-2016-0141)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2182 - possible buffer overflow in BNbn2dec - fix CVE-2016-6306 - certificate messag...

MGASA-2016-0342 Updated ruby packages fix a security vulnerability

A bug in openssl module caused using an all 0 IV for AES-GCM ciphers in some cases when setting a key, an iv, and then setting a key a again CVE-2016-779...

openssl security update

0.9.8e-40.0.3 - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2182 - possible buffer overflow in BNbn2dec - fix CVE-2016-6306 - certificate message OOB reads - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to...