RedHat Update for openssl RHSA-2016:0008-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

gnutls security update

CentOS Errata and Security Advisory CESA-2016:0012 Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

USN-2864-1 nss vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to...

CVE-2015-8744

QEMU aka Quick Emulator built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged CAPSYSRAWIO guest user could use this flaw to crash the QEMU process instance resulting in DoS...

UBUNTU-CVE-2015-8744

QEMU aka Quick Emulator built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged CAPSYSRAWIO guest user could use this flaw to crash the QEMU process instance resulting in DoS...

lldp 'assert()' function denial of service vulnerability

lldp Link Layer Discovery Protocol is a link layer discovery protocol that allows network devices to advertise their device identity and performance on the local subnet. A denial of service vulnerability exists in lldp. An attacker could exploit this vulnerability to crash the daemon and deny...

UBUNTU-CVE-2015-7575

Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...

Cisco FireSIGHT Management Center Security Mechanism Bypass Vulnerability

Cisco FireSIGHT Management Center is the United States Cisco Cisco company's set of support for centralized management of the use of FirePOWER Services Cisco ASA and Cisco FirePOWER network security equipment network security and operational functions of the management center software. A security...

Microsoft Bans Superfish SSL Interception Adware

Microsoft has taken steps to impede the next Superfish from impacting users. Superfish was pre-installed adware found on new Lenovo laptops earlier this year. The software exposes users to man-in-the-middle attacks because of the way it injects advertisements into the browser. It comes with a...

GnuTLS Padding Oracle Information Disclosure Vulnerability

GnuTLS is a free secure communications library for implementing the SSL, TLS and DTLS protocols developed by Nikos Mavrogiannopoulos of Belgium and Simon Josefsson of Sweden, software developers. An information disclosure vulnerability exists in GnuTLS. An attacker could exploit this vulnerabilit...

OpenSSL: Certificate verify crash with missing PSS parameter

A NULL pointer dereference flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacker could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication...

LATENTBOT: Trace Me If You Can

FireEye Labs recently uncovered LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless...

Cisco Small Business RV Router Information Disclosure Vulnerability

The Cisco Small Business RV Series routers provide virtual private network technology remote. Cisco Small Business RV Routers 4.x, SA500 Security Appliance Version 2.2.07 random number generator fails to have effective entropy, which can allow a remote attacker to determine the TLS key pair throu...

Microsoft Office CVE-2015-6177 Memory Corruption Vulnerability

Description Microsoft Office is prone to a remote memory-corruption vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. Technologies Affected...

TLS NPN Supported Protocol Enumeration

The remote host supports the TLS NPN Transport Layer Security Next Protocol Negotiation extension. This plugin enumerates the protocols the extension supports. TRUSTED...

Debian DSA-3413-1 : openssl - security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2015-3194 Loic Jonas Etienne of Qnective AG discovered that the signature verification routines will crash with a NULL...

CVE-2015-8328

Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to obtain sensitive information, cause a denial of service crash, or possibly gain privileges via unknown vectors...

CVE-2015-8328

Unspecified vulnerability in the NVAPI support layer in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to obtain sensitive information, cause a denial of service crash, or possibly gain privileges via unknown vectors...

Free WMA MP3 Converter Buffer Overflow Vulnerability

Free WMA MP3 Converter is a free WMA & MP3 converter to convert WMA to MP3, MP3 to WMA and more. A local buffer overflow vulnerability exists in Free WMA MP3 Converter v1.8. Local attackers use this vulnerability to process windows software, overwrite registers, and elevate its privileges...