198 matches found
LibreSSL -- use-after-free
OpenBSD reports: A TLS client using session resumption may cause a use-after-free...
FreeBSD : LibreSSL -- NULL pointer dereference (88dfd92f-3b9c-11eb-929d-d4c9ef517024)
The LibreSSL project reports : Malformed ASN.1 in a certificate revocation list or a timestamp response token can lead to a NULL pointer dereference. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...
SUSE SLED15 / SLES15 Security Update : libssh2_org (SUSE-SU-2020:3551-1)
This update for libssh2org fixes the following issues : Version update to 1.9.0: bsc1178083, jscSLE-16922 Enhancements and bugfixes : - adds ECDSA keys and host key support when using OpenSSL - adds ED25519 key and host key support when using OpenSSL 1.1.1 - adds OpenSSH style key file reading -...
LibreSSL -- NULL pointer dereference
The LibreSSL project reports: Malformed ASN.1 in a certificate revocation list or a timestamp response token can lead to a NULL pointer dereference...
openSUSE Security Update : libssh2_org (openSUSE-2020-2126)
This update for libssh2org fixes the following issues : - Version update to 1.9.0: bsc1178083, jscSLE-16922 Enhancements and bugfixes : - adds ECDSA keys and host key support when using OpenSSL - adds ED25519 key and host key support when using OpenSSL 1.1.1 - adds OpenSSH style key file reading ...
Security update for libssh2_org (moderate)
openSUSE Security Update: Security update for libssh2org Announcement ID: openSUSE-SU-2020:2129-1 Rating: moderate References: 1130103 1178083 Cross-References: CVE-2019-17498 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862...
Fedora 33 : rpki-client (2020-f30b30c2d8)
rpki-client 6.8p1 ================= This is the second release based on OpenBSD 6.8. It includes the following changes to the previous release : - Incorporate OpenBSD 6.8 errata 006 of November 10, 2020: rpki-client incorrectly checks the manifest validity interval. In the portable version : - Ad...
Fedora 31 : rpki-client (2020-ce591c8f46)
rpki-client 6.8p1 ================= This is the second release based on OpenBSD 6.8. It includes the following changes to the previous release : - Incorporate OpenBSD 6.8 errata 006 of November 10, 2020: rpki-client incorrectly checks the manifest validity interval. In the portable version : - Ad...
Fedora 32 : rpki-client (2020-538e0ee110)
rpki-client 6.8p1 ================= This is the second release based on OpenBSD 6.8. It includes the following changes to the previous release : - Incorporate OpenBSD 6.8 errata 006 of November 10, 2020: rpki-client incorrectly checks the manifest validity interval. In the portable version : - Ad...
libressl:client: Heap-buffer-overflow in x509_constraints_uri_host
Project: https://github.com/libressl-portable/portable.git Detailed Report: https://oss-fuzz.com/testcase?key=5703967370379264 Project: libressl Fuzzing Engine: afl Fuzz Target: client Job Type: aflasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000005...
libressl:client: Heap-buffer-overflow in x509_constraints_extract_names
Project: https://github.com/libressl-portable/portable.git Detailed Report: https://oss-fuzz.com/testcase?key=6077145108185088 Project: libressl Fuzzing Engine: afl Fuzz Target: client Job Type: aflasanlibressl Platform Id: linux Crash Type: Heap-buffer-overflow READ 10 Crash Address:...
cryptofuzz:cryptofuzz-libressl-noasm: Heap-buffer-overflow in mbedtls_nist_kw_wrap
Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5109879700979712 Project: cryptofuzz Fuzzing Engine: afl Fuzz Target: cryptofuzz-libressl-noasm Job Type: aflasancryptofuzz Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash...
cryptofuzz:cryptofuzz-libressl-noasm: Use-of-uninitialized-value in AES_encrypt
Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5704214830645248 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-libressl-noasm Job Type: libfuzzermsancryptofuzz Platform Id: linux Crash Type:...
cryptofuzz:cryptofuzz-libressl-noasm: Heap-use-after-free in AES_wrap_key
Project: https://github.com/guidovranken/cryptofuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=5135165352574976 Project: cryptofuzz Fuzzing Engine: libFuzzer Fuzz Target: cryptofuzz-libressl-noasm Job Type: libfuzzerasancryptofuzz Platform Id: linux Crash Type: Heap-use-after-free REA...
CVE-2019-9498
A flaw was found in wpasupplicant. An attack using invalid scalar/element values is possible against the EAP-pwd server since hostapd and wpasupplicant did not validate these values in the received EAP-pwd-Commit messages. When processing an EAP-pwd Commit frame, the peer's scalar and element...
libressl:asn1: Crash in asn1_item_print_ctx
Project: https://github.com/libressl-portable/portable.git Detailed Report: https://oss-fuzz.com/testcase?key=5098483184041984 Project: libressl Fuzzing Engine: libFuzzer Fuzz Target: asn1 Job Type: libfuzzerasanlibressl Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x60a000280000...
CVE-2015-5333
Memory leak in the OBJobj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service memory consumption via a large number of ASN.1 object identifiers in X.509 certificates...
Memory corruption
Memory leak in the OBJobj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service memory consumption via a large number of ASN.1 object identifiers in X.509 certificates...
CVE-2015-5334
Off-by-one error in the OBJobj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service program crash or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an...
Stack overflow
Off-by-one error in the OBJobj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service program crash or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an...