Ubuntu: Security Advisory (USN-1898-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : openssl vulnerability (USN-1898-1)

The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext content by observing length differences during a series of guesses in which a provided string potentially...

USN-1898-1: OpenSSL vulnerability

The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows machine-in-the-middle attackers to obtain plaintext content by observing length differences during a series of guesses in which a provided string potentially...

SuSE 11.2 Security Update : OpenSSL (SAT Patch Number 7548)

OpenSSL has been updated to fix several security issues : - Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable 'OPENSSLNODEFAULTZLIB' to 'no' enables compression again. CVE-2012-4929 - Timing attacks against TLS could be used by physically loc...

SuSE 10 Security Update : OpenSSL (ZYPP Patch Number 8517)

OpenSSL has been updated to fix several security issues : - Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable 'OPENSSLNODEFAULTZLIB' to 'no' enables compression again. CVE-2012-4929 Please note that openssl on SUSE Linux Enterprise 10 is not...

SUSE-SU-2015:1184-2 Security update for OpenSSL

OpenSSL has been updated to fix several security issues: CVE-2012-4929: Avoid the openssl CRIME attack by disabling SSL compression by default. Setting the environment variable 'OPENSSLNODEFAULTZLIB' to 'no' enables compression again. CVE-2013-0169: Timing attacks against TLS could be used by...

SSL/TLS CRIME attack against HTTPS

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

RHEL 5 / 6 : openssl (RHSA-2013:0587)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0587 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a...

Mandriva Linux Security Advisory : apache (MDVSA-2013:015-1)

Multiple vulnerabilities has been found and corrected in apache ASF HTTPD : Various XSS cross-site scripting vulnerability flaws due to unescaped hostnames and URIs HTML output in modinfo, modstatus, modimagemap, modldap, and modproxyftp CVE-2012-3499. XSS cross-site scripting vulnerability in...

SuSE 11.2 Security Update : Qt4 (SAT Patch Number 6935)

libqt4 has been updated to fix the 'CRIME' attack where compression using SSL connections have side-channel attacks to leak plaintext or cryptographic keys. Compression has been disabled to mitigate the CRIME attack. CVE-2012-4929 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Debian: Security Advisory (DSA-2579-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 2579-1 (apache2)

The remote host is missing an update to apache2 announced via advisory DSA 2579-1. OpenVAS Vulnerability Test $Id: deb25791.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2579-1 apache2 Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

[SECURITY] [DSA 2579-1] apache2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2579-1 [email protected] http://www.debian.org/security/ Stefan Fritsch November 30, 2012 http://www.debian.org/security/faq -...

DSA-2579-1 apache2 - several

Bulletin has no description...

Check Point response to CVE-2012-4929, CVE-2012-4930 aka CRIME attack

...

CVE-2012-4930

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing...

DEBIAN-CVE-2012-4929

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

CVE-2012-4929

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

Design/Logic Flaw

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

Design/Logic Flaw

The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing...