2742 matches found
nss: signature forgery
The definitelengthdecoder function in lib/util/quickder.c in Mozilla Network Security Services NSS does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as...
Mandriva Linux Security Advisory : nss (MDVSA-2014:252)
Updated nss packages fix security vulnerabilities : In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data CVE-2014-1569. This update adds support for the TLS Fallback Signaling Cipher Suite Value...
Fedora 20 : curl-7.32.0-17.fc20 (2014-16538)
make CURLOPTLOWSPEEDLIMIT work again with threaded resolver 1172572 - allow to use TLS 1.1 and TLS 1.2 1153814 - disable libcurl-level downgrade to SSLv3 1166567 - low-speed-limit: avoid timeout flood 1166239 - fix handling of CURLOPTCOPYPOSTFIELDS in curleasyduphandle CVE-2014-3707 Note that...
OpenSSL multiple security vulnerabilities
Poodle attack. Protocol version downgrade to SSL 3.0. Memory leaks in SRTP and session tickets. Insufficient no-ssl3 protection. Data leakage via padding attack...
Scientific Linux Security Update : nss, nss-util, and nss-softokn on SL5.x, SL6.x, SL7.x i386/x86_64 (20141202) (POODLE)
This update adds support for the TLS Fallback Signaling Cipher Suite Value TLSFALLBACKSCSV, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol...
CentOS 5 / 6 / 7 : nss (CESA-2014:1948) (POODLE)
Updated nss, nss-util, and nss-softokn packages that contain a patch to mitigate the CVE-2014-3566 issue, fix a number of bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security...
libzmq4 -- V3 protocol handler vulnerable to downgrade attacks
Pieter Hintjens reports: It is easy to bypass the security mechanism in 4.1.0 and 4.0.5 by sending a ZMTP v2 or earlier header. The library accepts such connections without applying its security mechanism...
Splunk Enterprise 5.0.x < 5.0.10 / 6.1.x < 6.1.4 Multiple Vulnerabilities
According to its version number, the Splunk Enterprise hosted on the remote web server is 5.0.x prior to 5.0.10 or 6.1.x prior to 6.1.4. It is, therefore, affected by the following vulnerabilities : - The included OpenSSL library contains a TLS downgrade weakness. By using fragmented ClientHello...
nss security update
CentOS Errata and Security Advisory CESA-2014:1948 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2014-December/082957.html https://lists.centos.org/pipermail/centos-announce/2014-December/082962.html...
MGASA-2014-0507 Updated firefox & thunderbird packages fix security vulnerabilities
Updated nss, firefox, and thunderbird packages fix security vulnerabilities: In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data CVE-2014-1569. Several flaws were found in the processing of malformed web...
Oracle Linux 5 / 6 / 7 : nss / nss-softokn / nss-util (ELSA-2014-1948) (POODLE)
From Red Hat Security Advisory 2014:1948 : Updated nss, nss-util, and nss-softokn packages that contain a patch to mitigate the CVE-2014-3566 issue, fix a number of bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated th...
RHEL 5 / 6 / 7 : nss, nss-util, and nss-softokn (RHSA-2014:1948) (POODLE)
Updated nss, nss-util, and nss-softokn packages that contain a patch to mitigate the CVE-2014-3566 issue, fix a number of bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security...
Important: Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 openssl security update
An update for the openssl component for Red Hat JBoss Web Server 2.1.0 that provides a patch to mitigate the CVE-2014-3566 issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Red Hat JBoss Web Server is a ful...
openSUSE Security Update : zeromq (openSUSE-SU-2014:1493-1)
zeromq was updated to version 4.0.5 to fix two security issues and various other bugs. These security issues were fixed : - Did not validate the other party's security handshake properly, allowing a man-in-the-middle downgrade attack CVE-2014-7202. - Did not implement a uniqueness check on...
OracleVM 3.3 : openssl (OVMSA-2014-0012)
The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to...
CVE-2014-8627
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...
Code injection
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...
CVE-2014-8627
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...
CVE-2014-8627
CVE-2014-8627 affects PolarSSL 1.3.8 where signature algorithm negotiation is flawed, enabling downgrade-like scenarios via unspecified vectors. Public sources (NVD/NASL/Nessus/OpenVAS) describe downgrad e risk and context; a patch path is to upgrade to newer PolarSSL versions (e.g., 1.3.9) as no...
