EulerOS 2.0 SP3 : openssl (EulerOS-SA-2018-1179)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - There is a carry propagating bug in the x8664 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms...

DDoS-Happy ‘Bitcoin Baron’ Sentenced to Almost 2 Years in Jail

The Bitcoin Baron, a self-proclaimed vigilante responsible for DDoS attacks on civic networks in Madison, Wisc., San Marcos, Texas, and other sites in 2015, has been collared in Phoenix and sentenced to serve 20 months in prison. The conviction and sentencing is only for the former attack, in whi...

3 Charged In Fatal Kansas ‘Swatting’ Attack

Federal prosecutors have charged three men with carrying out a deadly hoax known as "swatting," in which perpetrators call or message a target's local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target's address -- with the expectation that local police may...

openssl security and bug fix update

1.0.2k-12.0.1 - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.2k-12 - fix CVE-2017-3737 - incorrect handling of fatal error state - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus 1.0.2k-11 - fix deadlock in RNG in the FIPS mode in mariadb...

openssl: Read/write after SSL object in error state

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

Chrome: V8: Integer overflow with PropertyArray

Here's a snippet of the MigrateFastToFast function which is used to create a new PropertyArray object. int numberoffields = newmap-NumberOfFields; int inobject = newmap-GetInObjectProperties; int unused = newmap-UnusedPropertyFields; ... int totalsize = numberoffields + unused; int external =...

CVE-2017-3737 - Read, write after SSL object in error state. (BSA-2018-527).

Security Advisory ID: BSA-2018-527 Component: OpenSSL Revision : 3.0: Final OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake, then OpenSSL would move into the error state and would immediately fail i...

Serial SWATter Tyler “SWAuTistic” Barriss Charged with Involuntary Manslaughter

Tyler Raj Barriss, a 25-year-old serial "swatter" whose phony emergency call to Kansas police last month triggered a fatal shooting, has been charged with involuntary manslaughter and faces up to eleven years in prison. Tyler Raj Barriss, in an undated selfie. Barriss's online alias -- "SWAuTisti...

Updated openssl packages fix security vulnerabilities

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

Security update for openssl (important)

This update for openssl fixes the following issues: - OpenSSL Security Advisory 07 Dec 2017 CVE-2017-3737: OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error...

DEBIAN-CVE-2017-3737

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

CVE-2017-3737

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

CVE-2017-3737

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

CVE-2017-3737

OpenSSL 1.0.2 introduced an error state for fatal handshake errors. A bug causes SSL_read()/SSL_write() to bypass decryption/encryption if called after a fatal error, allowing data to pass without proper TLS processing. Affected: OpenSSL 1.0.2b–1.0.2m (including 1.0.2k/1.0.2n fixes noted). OpenSS...

UBUNTU-CVE-2017-3737

OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the...

OpenSSL -- multiple vulnerabilities

The OpenSSL project reports: Read/write after SSL object in error state CVE-2017-3737 OpenSSL 1.0.2 starting from version 1.0.2b introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediate...

SSL Handshake Failure on ADC Because of Unsupported Ciphers

SSL connection failsbetween the client and the ADCappliance ADC responds with a fatal alert. The description of the alert message is “Handshake Failure 40”. The above screenshot is from a NetScaler trace packet capture. Procedure to run a trace on the ADC is explained in the following document:...

Smart Locks Bricked by Bad Update

A botched wireless update for a remotely accessible smart lock system has bricked hundreds of them. The locks suffered a “fatal error,” according to device’s manufacturer LockState, rendering them unable to locked. Customers are asked to either return impacted locks for repair, or request a...

Fedora 25 : php-horde-kronolith (2017-692c05119d)

kronolith 4.2.22 - jan SECURITY: Fix open redirects. - mjr Prevent broken iCalendar files from causing fatal errors Bug 14672. - jan Work around calendar servers advertising as CalDAV-capable, but ignoring CalDAV requests Bug 14662. - jan Fix displaying yesterday's event in Prior Events portal...

Fedora 26 : php-horde-kronolith (2017-ceb60ebf8f)

kronolith 4.2.22 - jan SECURITY: Fix open redirects. - mjr Prevent broken iCalendar files from causing fatal errors Bug 14672. - jan Work around calendar servers advertising as CalDAV-capable, but ignoring CalDAV requests Bug 14662. - jan Fix displaying yesterday's event in Prior Events portal...