Internet Bug Bounty: CVE-2017-3730: Bad (EC)DHE parameters cause a client crash

https://www.openssl.org/news/secadv/20170126.txt https://guidovranken.wordpress.com/2017/01/26/cve-2017-3730-openssl-1-1-0-remote-client-denial-of-service-affects-servers-as-well-poc/...

Vulnerability in OpenSSL - Bad (EC)DHE parameters cause a client crash

If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack. Found by Guido Vranken...

OpenSSL -- multiple vulnerabilities

The OpenSSL project reports: Truncated packet could crash via OOB read CVE-2017-3731 Bad ECDHE parameters cause a client crash CVE-2017-3730 BNmodexp may produce incorrect results on x8664 CVE-2017-3732 Montgomery multiplication may produce incorrect results CVE-2016-7055...

tigervnc: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way TigerVNC handled screen sizes. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code on the client...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

CVE-2015-5291

Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS formerly PolarSSL 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code via a long hostname to the server name indication SNI...

Heap overflow

Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS formerly PolarSSL 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code via a long hostname to the server name indication SNI...

CVE-2015-5291

CVE-2015-5291 and CVE-2015-8036 describe heap-based buffer overflows in PolarSSL (mbed TLS) that affect PolarSSL 1.x before 1.2.17 and mbed TLS 1.3.x before 1.3.14 and 2.x before 2.1.2. The flaw stems from improper boundary handling of the hostname/SNI extension in ClientHello, enabling remote at...

CVE-2015-8036

Heap-based buffer overflow in ARM mbed TLS formerly PolarSSL 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handl...

PT-2015-6835

Name of the Vulnerable Software and Affected Versions PolarSSL versions 1.x through 1.2.16 ARM mbed TLS formerly PolarSSL versions 1.3.x through 1.3.13 ARM mbed TLS formerly PolarSSL versions 2.x through 2.1.1 Description A heap-based buffer overflow issue exists, allowing remote SSL servers to...

SUSE-SU-2015:1707-2 Security update for libssh

The encryption library libssh was updated to fix one security issue. The following vulnerability was fixed: CVE-2015-3146: Unauthenticated remote attackers could crash the server or client with specially crafted packages...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

openSUSE Security Update : tor (openSUSE-2015-300)

Tor was updated to 0.2.4.27 to fix two security issues that could be used by an attacker to crash hidden services, or crash clients visiting hidden services. Hidden services should upgrade as soon as possible. The following security issues were fixed : - A malicious client could trigger an...

krb5: double-free flaw in SPNEGO initiators

A double-free flaw was found in the MIT Kerberos SPNEGO initiators. An attacker able to spoof packets to appear as though they are from an GSSAPI acceptor could use this flaw to crash a client application that uses MIT Kerberos...

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way screen sizes were handled by LibVNCServer. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code in the client...

Oracle Solaris Third-Party Patch Update : openssl (cve_2010_5298_race_conditions)

The remote Solaris system is missing necessary patches to address security updates : - Race condition in the ssl3readbytes function in s3pkt.c in OpenSSL through 1.0.1g, when SSLMODERELEASEBUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service...

Important: Red Hat Security Advisory: libXfont security update

Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way screen sizes were handled by LibVNCServer. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code in the client...

libvncserver: NULL pointer dereference flaw in framebuffer setup

A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash...