CVE-2004-2761

The MD5 Message-Digest Algorithm is not collision-resistant, allowing attackers to conduct spoofing attacks by generating certificates with the same digital signature as a legitimate service. This vulnerability affects multiple products including Red Hat Certificate System (RHSA-2010:0838), HPE I...

PT-2009-1143

Name of the Vulnerable Software and Affected Versions MD5 affected versions not specified Description The MD5 Message-Digest Algorithm lacks collision resistance, making it easier for attackers to conduct spoofing attacks. This issue has been demonstrated through attacks on the use of MD5 in the...

SSL Certificate Signed Using Weak Hashing Algorithm

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm e.g. MD2, MD4, MD5, or SHA1. These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the sam...

SSL Certificate Forgery via MD5 Collision Attacks

Public key infrastructure PKI is a mechanism used for issuing digital certificates for secure websites. A critical vulnerability was detected in PKI that enables attackers to create a forged digital certificate that will be trusted by all common web browsers. The vulnerability is due to a weaknes...

MD5 vulnerable to collision attacks

Overview Weaknesses in the MD5 algorithm allow for collisions in output. As a result, attackers can generate cryptographic tokens or other data that illegitimately appear to be authentic. Description A secure cryptographic hash algorithm is one that generates a unique identifier of a fixed size...

Fake valid SSL certificate creation attack was successfully demonstrated

Valid fake SSL certificate creation attack was demonstratedby exploiting MD5 collisions and RapidSSL certificate generation procedures. The cost of attack is appoximately $2000...

CVE-2007-6319: Undefined Security Weakness

Multiple unspecified vulnerabilities in Lyris ListManager 8.x before 8.95d, 9.2 before 9.2c, and 9.3 before 9.3b allow remote attackers to 1 gain list administrator privileges or 2 access arbitrary mailing lists via unknown vectors related to modification of client-side information; and 3 allow...

Ubuntu 6.06 LTS : firefox regression (USN-428-2)

USN-428-1 fixed vulnerabilities in Firefox 1.5. However, changes to library paths caused applications depending on libnss3 to fail to start up. This update fixes the problem. We apologize for the inconvenience. Several flaws have been found that could be used to perform Cross-site scripting...

openSUSE 10 Security Update : kernel (kernel-2705)

This kernel update fixes the following security problems : - CVE-2006-5751: An integer overflow in the networking bridge ioctl starting with Kernel 2.6.7 could be used by local attackers to overflow kernel memory buffers and potentially escalate privileges 222656 - CVE-2006-6106: Multiple buffer...

Important: kernel security and bug fix update

2.6.18-8.1.4.0.1.el5 -Fix bonding primary=ethX so it picks correct network Bert Barbe IT 101532 ORA 5136660 -Add entropy module option to e1000 John Sobecki ORA 6045759 -Add entropy module option to bnx2 John Sobecki ORA 6045759 2.6.18.8.1.4.el5 - ipv6 Fix routing regression. David S. Miller 2380...

fetchmail/mutt/evolution/...: APOP password disclosure vulnerability

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

CVE-2007-1558: Undefined Security Weakness

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

GLSA-200703-08 : SeaMonkey: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200703-08 SeaMonkey: Multiple vulnerabilities Tom Ferris reported a heap-based buffer overflow involving wide SVG stroke widths that affects SeaMonkey. Various researchers reported some errors in the JavaScript engine potentially...

SeaMonkey: Multiple vulnerabilities

Background The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the 'Mozilla Application Suite'. Description Tom Ferris reported a heap-based buffer overflow involving wide SVG stroke widths that affects SeaMonke...

GLSA-200703-04 : Mozilla Firefox: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200703-04 Mozilla Firefox: Multiple vulnerabilities Tom Ferris reported a heap-based buffer overflow involving wide SVG stroke widths that affects Mozilla Firefox 2 only. Various researchers reported some errors in the JavaScript...

Important: kernel security update

2.6.9-42.0.10.0.1 -Fix bonding primary=ethX so it picks correct network Bert Barbe IT 101532 ORA 5136660 2.6.9-42.0.10 -fix key serial number collision problem David Howells 227495 CVE-2007-0006 -fix audit panic on watched files Eric Paris 223129 CVE-2007-0001 2.6.9-42.0.9 -fix icmp oops in sctp...

security flaw

The key serial number collision avoidance code in the keyallocserial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service crash via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."...

security flaw

The page cache feature in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 can generate hash collisions that cause page data to be appended to the wrong page cache, which allows remote attackers to obtain sensitive information or enable further attack vectors whe...

CVE-2007-0006

The key serial number collision avoidance code in the keyallocserial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service crash via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."...

Digipass Go3 Token Dumper (at least for 2006)

The initial reverse engineering of Vasco’s Digipass Go3 algorithm follows in C++. I think this implementation is a "rough" approximation, if we take some limitations about 2006 and the calculations made into account. Or I'm just joking… : This generator was able to predict an "otp" collision,...