openSUSE: Security Advisory for nodejs4 (openSUSE-SU-2018:2667-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for nodejs4 (moderate)

This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer bsc1105019 - Upgrade to OpenSSL 1.0.2p, which fixed: - CVE-2018-0732: Client...

node.js -- multiple vulnerabilities

Node.js reports: OpenSSL: Client DoS due to large DH parameter This fixes a potential denial of service DoS attack against client connections by a malicious server. During a TLS communication handshake, where both client and server agree to use a cipher-suite using DH or DHE Diffie-Hellman, in bo...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openssl-1.0.2p-i586-1slack14.2.txz: Upgraded. This update fixes two low severity security issues: Client DoS due to large DH paramete...

FreeBSD : OpenSSL -- Client DoS due to large DH parameter (c82ecac5-6e3f-11e8-8777-b499baebfeaf)

The OpenSSL project reports : During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until...

Internet Bug Bounty: Client DoS due to large DH parameter (CVE-2018-0732)

https://www.openssl.org/news/secadv/20180612.txt OpenSSL Security Advisory 12 June 2018 ======================================== Client DoS due to large DH parameter CVE-2018-0732 ==================================================== Severity: Low During key agreement in a TLS handshake using a DH...

Vulnerability in OpenSSL - Client DoS due to large DH parameter

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

OpenSSL -- Client DoS due to large DH parameter

The OpenSSL project reports: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until...

httpd security update

2.2.3-92.0.1 - Add the ability to read DH parameters from the first SSLCertificateFile John Haxby orabug 21671194 - fix modssl always performing full renegotiation Joe Jin orabug 12423387 - replace index.html with Oracle's index page oracleindex.html - update vstring and distro in specfile 2.2.3-...

Updated socat packages fix security vulnerability

In socat before 2.0.0-b9, in the OpenSSL address implementation, the hard coded 1024 bit DH p parameter was not prime. It may be possible for an eavesdropper to recover the shared secret from a key exchange CVE-2016-2217. In socat before 2.0.0-b9, a stack overflow vulnerability was found that can...

FreeBSD : socat -- diffie hellman parameter was not prime (a52a7172-c92e-11e5-96d6-14dae9d210b8)

socat reports : In the OpenSSL address implementation the hard-coded 1024 bit DH p parameter was not prime. The effective cryptographic strength of a key exchange using these parameters was weaker than the one one could get by using a prime p. Moreover, since there is no indication of how these...

openssl -- multiple vulnerabilities

OpenSSL project reports: Historically OpenSSL only ever generated DH parameters based on "safe" primes. More recently in version 1.0.2 support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be "safe". Wher...

openssl security update

0.9.8e-36.0.1 - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - fix CVE-2014-3570 - Bignum squaring may produce incorrect results - fix CVE-2014-3571 - DTLS segmentation fault in dtls1getrecord - fix CVE-2014-3572 - ECDHE silently downgrades to ECDH Client 0.9.8e-36 - als...

ourphp最新版注入漏洞又1枚（可出任意数据）

简要描述： ourphp最新版注入漏洞又1枚 详细说明： 看到wooyun上ourphp这个厂商又出新的版本了，说修改了wooyun上现有的漏洞，我也来凑凑热闹吧。下载最新版本（ourphpv1.2.0.20150414），2015-04-14更新的，研究学习一下。 注入一枚（这个地方前面提了下个漏洞了，当时没有注意到竟然还有个参数存在注入，无心刷洞）： GET /client/user/?cn-usershopping.html-&ourphpcms=del&id=1&dh=1 其中dh未过滤，存在注入，看代码 无关代码 elseif $GET"ourphpcms" == "del"...