OpenSSL ssl_get_algorithm2 TLS Denial of Service - ver 2 (CVE-2013-6449)

A denial of service vulnerability has been reported in OpenSSL. The vulnerability is due to an error in sslgetalgorithms2 where the SSL/TLS version is obtained from an incorrect structure leading to a NULL pointer dereference when computing a message digest. A remote unauthenticated attacker can...

POSH多个安全漏洞

Bugtraq ID:65818 POSH是一个基于PHP的WEB应用。 POSH存在多个安全漏洞，包括多个跨站脚本，任意URL重定向和设计漏洞，允许攻击者利用漏洞获取敏感信息或劫持用户会话，及获取用户名和密码MD5摘要信息。 0 POSH = 3.2.1 目前没有详细解决方案提供： http://sourceforge.net/projects/posh/...

GLSA-201401-33 : Perl Digest-Base module: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201401-33 Perl Digest-Base module: Arbitrary code execution The vulnerability is caused due to the Digest-new function not properly sanitising input before using it in an eval call. Impact : The vulnerability might allow an attack...

Perl Digest-Base module: Arbitrary code execution

Background Digest-Base is a set of Perl modules that calculate message digests Description The vulnerability is caused due to the “Digest-new” function not properly sanitising input before using it in an “eval” call. Impact The vulnerability might allow an attacker to execute arbitrary code...

RedHat Update for openssl RHSA-2014:0015-01

Check for the Version of openssl OpenVAS Vulnerability Test RedHat Update for openssl RHSA-2014:0015-01 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Important: openssl

Issue Overview: A flaw was found in the way OpenSSL determined which hashing algorithm to use when TLS protocol version 1.2 was enabled. This could possibly cause OpenSSL to use an incorrect hashing algorithm, leading to a crash of an application using the library. CVE-2013-6449 It was discovered...

openssl: crash in DTLS renegotiation after packet loss

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

DEBIAN-CVE-2013-6450

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

CVE-2013-6450

CVE-2013-6450 affects OpenSSL DTLS retransmission handling. The vulnerability arises from improper maintenance of digest/encryption context data structures during DTLS retransmission, in particular related to ssl/d1_both.c and ssl/t1_enc.c, which can allow a remote attacker to trigger a crash of ...

DEBIAN-CVE-2013-7039

Stack-based buffer overflow in the MHDdigestauthcheck function in libmicrohttpd before 0.9.32, when MHDOPTIONCONNECTIONMEMORYLIMIT is set to a large value, allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long URI in an authentication header...

UBUNTU-CVE-2013-7039

Stack-based buffer overflow in the MHDdigestauthcheck function in libmicrohttpd before 0.9.32, when MHDOPTIONCONNECTIONMEMORYLIMIT is set to a large value, allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a long URI in an authentication header...

Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection

This module exploits a SQL injection vulnerability in the "explorer" action of "miqpolicy" controller of the Red Hat CloudForms Management Engine 5.1 ManageIQ Enterprise Virtualization Manager 5.0 and earlier by changing the password of the target account to the specified password. Module Options...

Code injection

The kernel in Apple Mac OS X before 10.9 does not properly determine the output length for SHA-2 digest function calls, which allows context-dependent attackers to cause a denial of service panic by triggering a digest operation, as demonstrated by an IPSec connection...

GLSA-201310-01 : Perl Module-Signature module: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201310-01 Perl Module-Signature module: Arbitrary code execution The cpansign verify command will automatically download keys and use them to check the signature of CPAN packages via the SIGNATURE file. If an attacker were to...

Amazon Linux AMI : perl (ALAS-2011-19)

A heap-based buffer overflow flaw was found in the way Perl decoded Unicode strings. An attacker could create a malicious Unicode string that, when decoded by a Perl program, would cause the program to crash or, potentially, execute arbitrary code with the permissions of the user running the...

Amazon Linux AMI : tomcat6 (ALAS-2011-25)

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret...

Design/Logic Flaw

The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/...

CVE-2013-2145

The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/...

CVE-2013-2145

The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/...

Oracle Linux 6 : tomcat6 (ELSA-2013-0869)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0869 advisory. - Related: rhbz955976 CVE-2013-1976. Changed log location - Resolves: rhbz956771 Related: CVE-2012-3439 digest - Resolves: rhbz955976 CVE-2013-1976...