httpd, mod_ssl security update

CentOS Errata and Security Advisory CESA-2009:1075 Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and...

Mandrake Security Advisory MDVSA-2009:114 (ipsec-tools)

The remote host is missing an update to ipsec-tools announced via advisory MDVSA-2009:114. OpenVAS Vulnerability Test $Id: mdksa2009114.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:114 ipsec-tools Authors: Thomas Reinke Copyright: Copyright c 2009...

OpenSSL DTLS报文多个拒绝服务漏洞

Bugraq ID: 35001 CVE ID：CVE-2009-1378 CVE-2009-1377 CNCVE ID：CNCVE-20091378 CNCVE-20091377 OpenSSL是一款开放源码的SSL实现，用来实现网络通信的高强度加密。 OpenSSL存在多个漏洞，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 -OpenSSL库没有正确限制缓冲DTLS记录的数值，提交特殊构建的DTLS报文可导致消耗所有内存。 -处理DTLS消息时存在错误，通过发送大量乱序的握手消息可消耗大量内容。 OpenSSL Project OpenSSL 0.9.8 k OpenSSL...

CVE-2009-1377

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

CVE-2009-1377

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

Design/Logic Flaw

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

CVE-2009-1377

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

CVE-2009-1377

OpenSSL 0.9.8k and earlier contains a DTLS buffering bug in dtls1_buffer_record (ssl/d1_pkt.c) that allows a remote attacker to cause denial of service via memory consumption by queuing a large sequence of DTLS records with a future epoch. The issue is documented in CVE-2009-1377 and tied to the ...

CVE-2009-1377

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

CVE-2009-1377: Improper Restriction of Operations within the Bounds of a Memory Buffer

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

Design/Logic Flaw

Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service memory consumption via vectors involving 1 signature verification during user authentication with X.509 certificates, related to the eaycheckx509sign function in src/racoon/cryptoopenssl.c; and 2...

Memory corruption

Memory leak in the dequotebytea function in quote.c in the DBD::Pg aka DBD-Pg or libdbd-pg-perl module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service memory consumption by fetching data with BYTEA columns...

Mandriva Linux Security Advisory : libid3tag (MDVSA-2008:103)

field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service CPU and memory consumption via an ID3FIELDTYPESTRINGLIST field that ends in '', which triggers an infinite loop. The updated packages have been patched to correct this. %NASLMINLEVEL 70300 C...

Mandriva Linux Security Advisory : apache (MDVSA-2008:195)

A vulnerability was discovered in the modproxy module in Apache where it did not limit the number of forwarded interim responses, allowing remote HTTP servers to cause a denial of service memory consumption via a large number of interim responses CVE-2008-2364. A cross-site scripting vulnerabilit...

Mandriva Linux Security Advisory : libxml2 (MDVSA-2008:212)

libxml2 version 2.7.0 and 2.7.1 did not properly handle predefined entities definitions in entities, which allowed context-dependent attackers to cause a denial of service memory consumption and application crash via certain XML documents CVE-2008-4409. The updated packages have been patched to...

Ubuntu 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.22 vulnerabilities (USN-751-1)

NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. Ubuntu 8.10 was not affected. CVE-2008-4307 Sparc syscalls did not correctly check mmap regions. A local attacker could cause a...

Code injection

Foxy P2P software allows remote attackers to cause a denial of service memory consumption via a foxy URI with a download action and a large fs value...

CVE-2008-6742

Foxy P2P software allows remote attackers to cause a denial of service memory consumption via a foxy URI with a download action and a large fs value...

CVE-2008-6742

Foxy P2P software allows remote attackers to cause a denial of service memory consumption via a foxy URI with a download action and a large fs value...

CVE-2008-6742

The CVE-2008-6742 entry describes a DoS in Foxy P2P software caused by processing a foxy URI with a download action and an excessively large fs parameter, leading to memory consumption. The vulnerability is network-exploitable, with no authentication required, and the available documents do not s...