198 matches found
macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)
The remote host is running a version of macOS that is 10.12.x prior to 10.12.4. It is, therefore, affected by multiple vulnerabilities in multiple components, some of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these remote code execution...
Apple Fixes 223 Vulnerabilities Across macOS, iOS, Safari
Apple fixed hundreds of bugs, 223 to be exact, across a slate of products including macOS Sierra, iOS, Safari, watchOS, and tvOS on Monday. More than a quarter of the bugs, 40 in macOS Sierra, and 30 in iOS, could lead to arbitrary code execution – in some instances with root privileges, Apple...
openSUSE Security Update : libressl (openSUSE-2017-222)
This update for libressl fixes the following issues : - CVE-2016-7056: Difficult to execute cache timing attack that may have allowed a local user to recover the private part from ECDSA P-256 keys boo1019334 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...
macOS 10.12.x < 10.12.2 Multiple Vulnerabilities
The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components : - apachemodphp - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia...
FreeBSD : OpenSSL -- multiple vulnerabilities (43eaa656-80bc-11e6-bf52-b499baebfeaf)
OpenSSL reports : High: OCSP Status Request extension unbounded memory growth SSLpeek hang on empty record SWEET32 Mitigation OOB write in MDC2Update Malformed SHA512 ticket DoS OOB write in BNbn2dec OOB read in TSOBJprintbio Pointer arithmetic undefined behaviour Constant time flag not preserved...
OpenSSL -- multiple vulnerabilities
OpenSSL reports: High: OCSP Status Request extension unbounded memory growth SSLpeek hang on empty record SWEET32 Mitigation OOB write in MDC2Update Malformed SHA512 ticket DoS OOB write in BNbn2dec OOB read in TSOBJprintbio Pointer arithmetic undefined behaviour Constant time flag not preserved ...
Apple Fixes Vulnerabilities Across OS X, iOS, Safari
Apple fixed dozens of vulnerabilities in its software on Monday, including 60 vulnerabilities in its operating system, OS X, and 43 in its mobile operating system, iOS. The OS X update graduates the desktop and server operating system to OS X El Capitan v10.11.6 and applies to anyone running OS X...
openSUSE Security Update : libressl (openSUSE-2016-604)
This libressl update to version 2.2.7 fixes the following issues : Security issues fixed : - Fix multiple vulnerabilities in libcrypto relating to ASN.1 and encoding. boo978492, boo977584 - CVE-2015-3194: Certificate verify crash with missing PSS parameter boo957815 - CVE-2015-3195: X509ATTRIBUTE...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe In most versions of PHP, it lies about being secure And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: Release a new version v1.3.0 or most likely v2.0.0 that doesn't rely...
Uses insecure CSPRNG (openssl_random_pseudo_bytes())
It's not fork safe - In most versions of PHP, it lies about being secure - And today I learned that OpenSSL, by default i.e. unchangable from PHP land uses MD5 as a CSPRNG thanks @atoponce I'm stuck between several possible avenues: - Release a new version v1.3.0 or most likely v2.0.0 that...
OpenSSL加密算法破解漏洞
一、漏洞情况分析 OpenSSL是一个实现安全套接层和安全传输层协议的通用开源加密库，可支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL存在一处加密算法破解漏洞，但是该漏洞需要同时满足以下条件：OpenSSL版本为 1.0.2-1.0.2e；依赖于openssl的应用程序的签名算法生成的临时密钥必须基于Diffie...
openSUSE Security Update : libressl (openSUSE-2015-916)
LibreSSL was updated to fix two security issues inherited from OpenSSL. The following vulnerabilities were fixed : - CVE-2015-3194: NULL pointer dereference in client side certificate validation - CVE-2015-3195: Memory leak in PKCS7 - not reachable from TLS/SSL %NASLMINLEVEL 70300 C Tenable Netwo...
Apple Mac OS X Multiple Vulnerabilities-01 (Dec 2015)
Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
FreeBSD : libressl -- NULL pointer dereference (215e740e-9c56-11e5-90e7-b499baebfeaf)
The OpenBSD project reports : A NULL pointer deference could be triggered by a crafted certificate sent to services configured to verify client certificates on TLS/SSL connections. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
LibreSSL memory leak vulnerability-vulnerability warning-the black bar safety net
Affected system: LibreSSL LibreSSL 2.0.0 - 2.3.0 Description: -------------------------------------------------------------------------------- CVECAN ID: CVE-2 0 1 5-5 3 3 3 LibreSSL is OpenSSL encryption software library a branch, is the Secure Sockets LayerSSLand Transport Layer...
openSUSE Security Update : libressl (openSUSE-2015-681)
libressl was updated to fix two security issues. These security issues were fixed : - CVE-2015-5333: Memory leak when decoding X.509 certificates boo950707 - CVE-2015-5334: Buffer overflow when decoding X.509 certificates boo950708 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
LibreSSL Memory Disclosure Vulnerability
LibreSSL is a fork of the OpenSSL cryptographic software library and is an open source implementation of the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. A memory leak vulnerability exists in the implementation of LibreSSL's OBJobj2txt function. A remote attacker could cau...
LibreSSL Buffer Overflow Vulnerability
LibreSSL is a fork of the OpenSSL cryptographic software library and is an open source implementation of the Secure Sockets Layer SSL and Transport Layer Security TLS protocols. LibreSSL's OBJobj2txt function suffers from a buffer overflow vulnerability in its implementation by writing NULL...
Qualys Security Advisory - LibreSSL (CVE-2015-5333 and CVE-2015-5334)
Qualys Security Advisory LibreSSL CVE-2015-5333 and CVE-2015-5334 ======================================================================== Contents ======================================================================== Summary Memory Leak CVE-2015-5333 Buffer Overflow CVE-2015-5334...