Mandriva Linux Security Advisory : tor (MDVSA-2014:123)

Updated tor packages fix multiple vulnerabilities : Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for relay identity keys and hidden-service identity keys,...

ESXi 5.5 < Build 1881737 OpenSSL Library Multiple Vulnerabilities (remote check)

The remote VMware ESXi host is 5.5 prior to build 1881737. It is, therefore, affected by the following vulnerabilities in the OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note this...

MGASA-2014-0256 Updated tor packages fix multiple vulnerabilities

Update to version 0.2.4.22 which solves these major and security problems: - Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL CVE-2014-0160. - Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step. -...

update to version 1.0.0m (critical)

The openssl library was updated to version 1.0.0m fixing various security issues and bugs: Security issues fixed: - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. -...

OpenSSL < 0.9.8za / < 1.0.0m / < 1.0.1h Multiple Vulnerabilities

Binary data 801619.prm...

Debian DSA-2950-1 : openssl - security update

Multiple vulnerabilities have been discovered in OpenSSL : - CVE-2014-0195 Jueri Aedla discovered that a buffer overflow in processing DTLS fragments could lead to the execution of arbitrary code or denial of service. - CVE-2014-0221 Imre Rad discovered the processing of DTLS hello packets is...

FreeBSD : OpenSSL -- multiple vulnerabilities (5ac53801-ec2e-11e3-9cf3-3c970e169bc2)

The OpenSSL Project reports : An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle MITM attack where the attacker can decrypt and modify traffic from the attacked client and...

openssl security update

Package: openssl Version: 0.9.8o-4squeeze15 CVE ID: CVE-2014-0076 CVE-2014-0195 CVE-2014-0221 CVE-2014-3470 CVE-2014-0224 CVE-2014-0195 Jueri Aedla discovered that a buffer overflow in processing DTLS fragments could lead to the execution of arbitrary code or denial of service. CVE-2014-0221 Imre...

USN-2232-1: OpenSSL vulnerabilities

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS fragments. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS...

[SECURITY] [DSA 2950-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2950-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 05, 2014 http://www.debian.org/security/faq -...

DSA-2950-1 openssl - security update

Bulletin has no description...

Debian Security Advisory DSA 2950-1 (openssl - security update)

Multiple vulnerabilities have been discovered in OpenSSL: CVE-2014-0195 Jueri Aedla discovered that a buffer overflow in processing DTLS fragments could lead to the execution of arbitrary code or denial of service. CVE-2014-0221 Imre Rad discovered the processing of DTLS hello packets is...

Vulnerability in OpenSSL - Anonymous ECDH denial of service

OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. Found by Felix Gröbert and Ivan Fratrić Google...

Fedora 19 : mingw-gnutls-3.1.21-1.fc19 (2014-2565)

Version 3.1.21 released 2014-02-13 - libgnutls: Tolerate servers that sent the SUPPORTED ECC extension. - libgnutls: Reduced the TLS and DTLS version requirements for all ciphersuites that are not GCM. - libgnutls: When two initial keywords are specified then treat the second as having the '+'...

[Harden SSL/TLS] Hardening the SSL/TLS settings

“Harden SSL/TLS” allows hardening the SSL/TLS settings of Windows 2000,2003,2008,2008R2, XP,Vista,7. It allows locally and remotely set SSL policies allowing or denying certain ciphers/hashes or complete ciphersuites. This tool specific allows setting policies with regards to what ciphers and...

Mandriva Linux Security Advisory : gnutls (MDVSA-2013:040)

Nadhem Alfardan and Kenny Paterson devised an attack that recovers some bits of the plaintext of a GnuTLS session that utilizes that CBC ciphersuites, by using timing information CVE-2013-1619. The gnutls package has been updated to latest 3.0.28 version to fix above problem. %NASLMINLEVEL 70300 ...

FreeBSD : FreeBSD -- OpenSSL multiple vulnerabilities (69bfc852-9bd0-11e2-a7be-8c705af55518)

A flaw in the OpenSSL handling of OCSP response verification could be exploited to cause a denial of service attack. OpenSSL has a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. The weakness could reveal plaintext in a timing attack. %NASLMINLEVEL 70300 C Tenable Network...

FreeBSD -- OpenSSL multiple vulnerabilities

A flaw in the OpenSSL handling of OCSP response verification could be exploited to cause a denial of service attack. OpenSSL has a weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS. The weakness could reveal plaintext in a timing attack...

FreeBSD-SA-13:03.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:03.openssl Security Advisory The FreeBSD Project Topic: OpenSSL multiple vulnerabilities Category: contrib Module: openssl Announced: 2013-04-02 Affects: All...

Vulnerability in OpenSSL - TLS 1.1 and 1.2 AES-NI crash

A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack. Found by Adam Langley and Wolfgang Ettlinger...