USN-5168-4 nss regression

USN-5168-3 fixed a vulnerability in NSS. Unfortunately that update introduced a regression that could break SSL connections. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS...

The vulnerability of the implementations of the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) in the Cisco Video Surveillance Series 7000 software-based IP cameras allows a intruder to trigger a service failure or cause the device to restart.

The vulnerability of the Cisco Discovery Protocol and Link Layer Discovery Protocol LLDP implementations in Cisco Video Surveillance devices of the 7000 series is related to a memory reclamation error. Exploiting this vulnerability can allow an attacker to trigger a system reboot or cause a servi...

ESRI ArcGIS Enterprise 安全漏洞

ESRI ArcGIS Enterprise is a GIS Geographic Information System based software system from Environmental Systems Research Institute ESRI. The system supports mapping and visualization, analysis, and data management. A security vulnerability exists in Esri ArcGIS Enterprise that could be exploited b...

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...

RHEL 6 : kernel (RHSA-2021:2735)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2735 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: sizet-to-int conversion...

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...

The vulnerability of Cisco Small Business LLDP switches, related to copying buffers without checking input data, allows a perpetrator to execute arbitrary code.

The vulnerability of Cisco Small Business LLDP switches lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of the Mozilla Firefox browser, related to improper restriction of the displayed user interface layers, allows attackers to carry out attacks using a suphin.

The vulnerability of the Mozilla Firefox browser is related to an improper limitation on the displayed layers of the user interface. Exploiting this vulnerability allows a malicious actor to display a JavaScript alert dialog box with arbitrary code, instead of the web page itself...

The vulnerability of the Mozilla Firefox browser, related to improper restriction of the displayed user interface layers, allows attackers to carry out attacks using a suphin.

The vulnerability of the Mozilla Firefox browser is related to an improper limitation on the displayed layers of the user interface. Exploiting this vulnerability allows a malicious actor to carry out attacks using a spoofing technique, by hiding requests from users for access to additional...

PT-2021-7990 · Sdl +5 · Sdl +5

Name of the Vulnerable Software and Affected Versions: SDL Simple DirectMedia Layer versions 2.x through 2.0.18 Description: The issue is related to a heap overflow problem in the src/video/SDL pixels.c component of the Simple DirectMedia Layer library. This can be exploited by a remote attacker...

The vulnerability of Cisco Small Business LLDP switches, related to copying buffers without checking input data, allows a perpetrator to execute arbitrary code.

The vulnerability of Cisco Small Business LLDP switches lies in the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of the Session Initiation Protocol (SIP) implementation and the Network Address Translation (NAT) function of the Application Layer Gateway (ALG) in microprogrammable network interface devices from Cisco Adaptive Security Appliances (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to circumvent security restrictions and establish unauthorized connections.

The vulnerability of the Session Initiation Protocol SIP implementation and the Network Address Translation NAT function of the Application Layer Gateway ALG in microprogrammable network devices such as Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to...

What is Transport Layer Security (TLS) ❓

The code suites and security impediments picked by any association utilizing Transport Layer Security TLS fundamentally affect the security of that association. This article will doubtlessly help you in settling on these choices to guarantee the privacy and decency of the client server...

Amazon AWS IoT Device SDK 信任管理问题漏洞

The Amazon AWS IoT Device SDK is a collection of C source files under the MIT Open Source License from Amazon.com, Inc. that can be used in embedded applications to securely connect IoT devices to the AWS IoT Core.It includes an MQTT, JSON parser, and the AWS IoT Device Shadow library. It is...

Amazon AWS IoT Device SDK 信任管理问题漏洞

The Amazon AWS IoT Device SDK is a collection of C source files under the MIT Open Source License from Amazon.com, Inc. that can be used in embedded applications to securely connect IoT devices to the AWS IoT Core.It includes an MQTT, JSON parser, and the AWS IoT Device Shadow library. It is...

OESA-2021-1440 libzapojit security update

GLib/GObject wrapper for the SkyDrive and Hotmail REST APIs. Security Fixes: In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to...

OESA-2021-1434 gfbgraph security update

GLib/GObject wrapper for the Facebook Graph API. Security Fixes: In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to...