GLSA-200910-01 : Wget: Certificate validation error

The remote host is affected by the vulnerability described in GLSA-200910-01 Wget: Certificate validation error The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character. Specifically, the processing of such fields is...

Wget: Certificate validation error

Background GNU Wget is a free software package for retrieving files using HTTP, HTTPS and FTP, the most widely-used Internet protocols. Description The vendor reported that Wget does not properly handle Common Name CN fields in X.509 certificates that contain an ASCII NUL \0 character...

Debian Security Advisory DSA 1896-1 (opensaml, shibboleth-sp)

The remote host is missing an update to opensaml, shibboleth-sp announced via advisory DSA 1896-1. OpenVAS Vulnerability Test $Id: deb18961.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1896-1 opensaml, shibboleth-sp Authors: Thomas Reinke Copyright:...

[SECURITY] [DSA 1896-1] New Shibboleth 1.x packages fix potential code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1896-1 [email protected] http://www.debian.org/security/ Florian Weimer September 28, 2009 http://www.debian.org/security/faq -...

Fedora Core 11 FEDORA-2009-8565 (gnutls)

The remote host is missing an update to gnutls announced via advisory FEDORA-2009-8565. OpenVAS Vulnerability Test $Id: fcore20098565.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8565 gnutls Authors: Thomas Reinke Copyright: Copyright c 2009 E-So...

Fedora 10 : gnutls-2.4.2-5.fc10 (2009-8622)

This update fixes handling of NUL characters in certificate Common Name or subjectAltName fields especially in regards to comparsion to hostnames. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora Core 10 FEDORA-2009-8622 (gnutls)

The remote host is missing an update to gnutls announced via advisory FEDORA-2009-8622. OpenVAS Vulnerability Test $Id: fcore20098622.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8622 gnutls Authors: Thomas Reinke Copyright: Copyright c 2009 E-So...

Fedora 11 : gnutls-2.6.6-3.fc11 (2009-8565)

This update fixes handling of NUL characters in certificate Common Name or subjectAltName fields especially in regards to comparsion to hostnames. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Fedora Core 11 FEDORA-2009-8565 (gnutls)

The remote host is missing an update to gnutls announced via advisory FEDORA-2009-8565. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 10 FEDORA-2009-8622 (gnutls)

The remote host is missing an update to gnutls announced via advisory FEDORA-2009-8622. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

DSA-1896-1 opensaml shibboleth-sp - potential code execution

Bulletin has no description...

cURL: Certificate validation error

Background cURL is a command line tool for transferring files with URL syntax, supporting numerous protocols. Description Scott Cantor reported that cURL does not properly handle fields in X.509 certificates that contain an ASCII NUL \0 character. Specifically, the processing of such fields is...

Fedora Core 11 FEDORA-2009-8815 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8815. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 10 FEDORA-2009-8794 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8794. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

gnutls security update

1.4.1-3.5 - fix NUL characters in DN and SAN cert fields issue, make sure gnutlsx509crtcheckhostname fails when certificate has no CN or SAN CVE-2009-2730 516231...

Fedora 11 : neon-0.28.6-1.fc11 (2009-8815)

This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...

curl: incorrect verification of SSL certificate with NUL in name

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

FreeBSD : fetchmail -- improper SSL certificate subject verification (5179d85c-8683-11de-91b9-0022157515b2)

Matthias Andree reports : Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...

fetchmail

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-2666 Here are the...

DEBIAN-CVE-2008-4326

The PMAescapeJsString function in libraries/jsescape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote attackers to bypass cross-site scripting XSS protection mechanisms and conduct XSS attacks via a NUL byte inside a "/script" sequence...