Updated openssl package fixes security vulnerability

During certificate verification, OpenSSL starting from version 1.0.1n and 1.0.2b will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted...

openssl: man-in-the-middle

During certificate verification, OpenSSL will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the ...

Vulnerability in OpenSSL - Alternative chains certificate forgery

An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate...

CVE-2015-3931 Microsec e-Szigno, CVE-2015-3932 Netlock Mokka XSW vulnerability

In November 2014, SEARCH-LAB Ltd. discovered a security vulnerability in Microsec e-Szigno, and Netlock Mokka computer applications that are used to generate and validate digital signatures, which are applied within the official Hungarian government processes. The vulnerability affected the...

CVE-2015-4238

Cisco ASA SNMP DoS (CVE-2015-4238) affects ASA Software 8.4(7) and 8.6(1.2). An authenticated remote attacker can cause a device reload by sending a high rate of SNMP requests during heavy network traffic due to SNMP handling/resource management issues (Bug CSCul02601). Impact is denial of servic...

SOL16879 - Apache Portable Runtime vulnerability CVE-2011-1928

The fnmatch implementation in aprfnmatch.c in the Apache Portable Runtime APR library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service infinite loop via a URI that does not match unspecified types of wildcard patterns, as demonstrated by...

[SECURITY] [DLA 262-1] libcrypto++ security update

Package : libcrypto++ Version : 5.6.0-6+deb6u1 CVE ID : CVE-2015-2141 Evgeny Sidorov discovered that libcrypto++, a general purpose C++ cryptographic library, did not properly implement blinding to mask private key operations for the Rabin-Williams digital signature algorithm. This could allow...

Amazon Releases S2N TLS Crypto Implementation to Open Source

Amazon today released to open source its own TLS implementation called s2n, which stands for signal to noise. While admittedly not meant to be a replacement for OpenSSL, for example, s2n is a slimmed-down crypto implementation analogous to libssl, the OpenSSL library that supports TLS. Amazon chi...

[SECURITY] [DSA 3296-1] libcrypto++ security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3296-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 29, 2015 https://www.debian.org/security/faq -...

Android Debugger vulnerability exists, you can get the device memory data-vulnerability warning-the black bar safety net

A structure of delicate ELFExecutable and Linkable Formatfile can cause the debugger to crash, and then through the tombstone file and the corresponding logd log files exposure of memory contents. This can be used for denial of service attacks, can help bypass ASLR to execute malicious code. Only...

USN-2654-1: Tomcat vulnerabilities

It was discovered that the Tomcat XML parser incorrectly handled XML External Entities XXE. A remote attacker could possibly use this issue to read arbitrary files. This issue only affected Ubuntu 14.04 LTS. CVE-2014-0119 It was discovered that Tomcat incorrectly handled data with malformed chunk...

CVE-2015-4641

Affected: Samsung Galaxy S4, S4 Mini, S5, S6 with SwiftKey language-pack update. Vulnerability: Directory traversal in the SwiftKey language-pack update implementation that uses the skslm.swiftkey.net domain. Cause: crafted ZIP entry containing a .. path can be exploited to write to arbitrary fil...

Debian DSA-3290-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leaks or data corruption. - CVE-2015-1805 Red Hat discovered that the pipe iovec read and write implementations may iterate over the iovec twice but will modify...

[SECURITY] [DSA 3290-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3290-1 [email protected] https://www.debian.org/security/ Ben Hutchings June 18, 2015 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3290-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3290-1 [email protected] https://www.debian.org/security/ Ben Hutchings June 18, 2015 https://www.debian.org/security/faq -...

DSA-3290-1 linux - security update

Bulletin has no description...

Debian Security Advisory DSA 3290-1 (linux - security update)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leaks or data corruption. CVE-2015-1805 Red Hat discovered that the pipe iovec read and write implementations may iterate over the iovec twice but will modify t...

CVE-2015-4144

CVE-2015-4144 affects hostapd and wpa_supplicant EAP-pwd server/peer implementations (versions 1.0–2.4). The issue is missing validation that a message is long enough to contain the Total-Length field, enabling a remote attacker to trigger a denial of service (crash) via crafted messages. The lin...

CVE-2015-0775

The banner aka MOTD implementation in Cisco NX-OS 4.12E11f on Nexus 4000 devices, 5.21SV32.1 on Nexus 1000V devices, 6.02N22 on Nexus 5000 devices, 6.211 on MDS 9000 devices, 6.212 on Nexus 7000 devices, 7.03 on Nexus 9000 devices, and 7.20ZN99.67 on Nexus 3000 devices allows remote attackers to...

CVE-2015-0775

The CVE-2015-0775 issue affects Cisco NX-OS banner/MOTD handling across multiple platforms (Nexus 4000, Nexus 1000V, Nexus 5000, MDS 9000, Nexus 7000, Nexus 9000, Nexus 3000). The vulnerability allows remote unauthenticated attackers to cause a denial of service by triggering a login-process rese...