24 matches found
CVE-2026-73260
The Mongoose embedded web server and network library is vulnerable to an out-of-bounds read due to a length-counter underflow in its built-in TLS X.509 DER parser (prior to version 7.23 ). Specifically, the functions mg_der_to_tlv() and mg_der_next() fail to verify if a long-form DER element leng...
CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...
CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...
CVE-2026-54697
The DER parser used for application-supplied private keys did not safely validate encoded length values before converting them to "Int" values or allocating arrays. A malformed private-key file could encode a length that overflowed or wrapped around, or request an allocation much larger than the...
PT-2026-56686
Name of the Vulnerable Software and Affected Versions ConnectBot SSH Client Library versions prior to 0.3.1 Description The DER parser used for application-supplied private keys fails to safely validate encoded length values before converting them to Int values or allocating arrays. In the...
Debian Security Advisory DSA 3688-1 (nss - security update)
Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of da...
Fedora 21 : suricata-2.0.8-1.fc21 (2015-7886)
This update fixes a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. Also, those processing large numbers of untrusted pcap files need to update as a malformed pcap could crash Suricata. Note that Tenable Network Security has extracted the preceding...
Fedora 22 : suricata-2.0.8-1.fc22 (2015-7730)
This update fixes a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. Also, those processing large numbers of untrusted pcap files need to update as a malformed pcap could crash Suricata. Note that Tenable Network Security has extracted the preceding...
DEBIAN-CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
Code injection
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971
CVE-2015-0971 affects Suricata’s DER parser used to decode SSL/TLS certificates. The vulnerability allows remote attackers to trigger a denial of service (crash) by sending crafted DER-encoded data, impacting Suricata versions prior to 2.0.8. Several advisories and posts (including Debian DSA-325...
CVE-2015-0971
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
CVE-2015-0971: Undefined Security Weakness
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service crash via vectors related to SSL/TLS certificates...
FreeBSD : suricata -- TLS/DER Parser Bug (DoS) (fe910ed6-f88d-11e4-9ae3-0050562a4d7b)
OISF Development Team reports : The OISF development team is pleased to announce Suricata 2.0.8. This release fixes a number of issues in the 2.0 series. The most important issue is a bug in the DER parser which is used to decode SSL/TLS certificates could crash Suricata. This issue was reported ...
PT-2015-4997
Name of the Vulnerable Software and Affected Versions Suricata versions prior to 2.0.8 Description The issue is related to the DER parser in Suricata, which can be exploited by remote attackers to cause a denial of service, resulting in a crash. This can be achieved through vectors related to...
