SuSE 11.3 Security Update : python (SAT Patch Number 8892)

This update for Python fixes the following security issues : - SSL module does not handle certificates that contain hostnames with NULL bytes. CVE-2013-4238. bnc834601 - Various stdlib read flaws. CVE-2013-1752 Additionally, the following non-security issues have been fixed:. bnc856836 - Turn off...

CVE-2013-2179

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service NULL pointer dereference and crash by attempting to log into an account whose...

Null pointer dereference

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service NULL pointer dereference and crash by attempting to log into an account whose...

CVE-2013-2179

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service NULL pointer dereference and crash by attempting to log into an account whose...

CVE-2013-2179

CVE-2013-2179 affects X.Org xdm 1.1.10 and 1.1.11 (and possibly other versions). The vulnerability arises when performing authentication using certain implementations of the crypt() API that can return NULL, enabling remote attackers to trigger a denial of service via a NULL pointer dereference (...

CVE-2013-2179

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service NULL pointer dereference and crash by attempting to log into an account whose...

Oracle Linux 6 : dracut (ELSA-2013-1674)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1674 advisory. 004-336.0.1 - do not strip modules with signatures. orabug 17458249 Jerry Snitselaar - scsiwait module removed in 3.8. Mute errors. orabug 16977193 Maxim Uvarov...

openssh security, bug fix, and enhancement update

5.3p1-94 - use dracut-fips package to determine if a FIPS module is installed 1001565 5.3p1-93 - use dist tag in suffixes for hmac checksum files 1001565 5.3p1-92 - use hmacsuffix for ssh,d hmac checksums 1001565 5.3p1-91 - fix NSS keys support 1004763 5.3p1-90 - change default value of MaxStartu...

dracut security, bug fix, and enhancement update

004-336.0.1 - do not strip modules with signatures. orabug 17458249 Jerry Snitselaar - scsiwait module removed in 3.8. Mute errors. orabug 16977193 Maxim Uvarov find firmware in /lib/modules/firmware/2.6.32-400.1.1.el5uek first and /lib/modules/firmware second Resolves: Orabug: 13351090 - Fix btr...

Dual_EC_DRBG output using untrusted curve constants may be predictable

Overview Output of the Dual Elliptic Curve Deterministic Random Bit Generator DUALECDRBG algorithm may be predictable by an attacker who has chosen elliptic curve parameters in advance. Description NIST SP 800-90A defines three elliptic curves for use in DualECDBRG but does not describe the...

CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

ALPINE-CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

Null pointer dereference

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

CVE-2013-4122

CVE-2013-4122 affects Cyrus SASL 2.1.23, 2.1.26 and earlier. The root cause is incorrect handling of when a NULL value is returned on error by the crypt function in glibc 2.17+, enabling remote DoS via (1) invalid salt or (2) DES or (3) MD5 passwords when FIPS-140 is enabled, triggering a NULL po...

CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

CVE-2013-4122

Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service thread crash and consumption via 1 an invalid salt or, when FIPS-140...

CVE-2007-6755

The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection...

CVE-2013-4132

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pwencrypt functions, which allows remote attackers to cause a denial of service NULL pointer dereference and crash via 1 an invalid salt or a 2 DES or 3 MD5 encrypted password, when FIPS-140 is...

Null pointer dereference

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pwencrypt functions, which allows remote attackers to cause a denial of service NULL pointer dereference and crash via 1 an invalid salt or a 2 DES or 3 MD5 encrypted password, when FIPS-140 is...

CVE-2013-4132

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pwencrypt functions, which allows remote attackers to cause a denial of service NULL pointer dereference and crash via 1 an invalid salt or a 2 DES or 3 MD5 encrypted password, when FIPS-140 is...