USN-2537-1: OpenSSL vulnerabilities

It was discovered that OpenSSL incorrectly handled malformed EC private key files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service, or execute arbitrary code. CVE-2015-0209 Stephen Henson discovered that OpenSSL incorrectly handled...

Updated openssl packages fix security vulnerabilities

Updated openssl packages fix security vulnerabilities: The function ASN1TYPEcmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1TYPEcmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verificati...

CVE-2015-0289

Summary: CVE-2015-0289 is a denial-of-service vulnerability in OpenSSL arising from incorrect handling of PKCS#7 data (NULL pointer dereference) during processing of PKCS#7 structures. The issue exists in the PKCS#7 parsing path and is triggered by malformed PKCS#7 inputs, potentially crashing ap...

openssl: multiple issues

CVE-2015-1787 denial of service If client auth is used then a server can segfault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. - CVE-2015-0207 denial of service The DTLSv1listen...

CVE-2015-0289

The PKCS7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service NULL pointer dereference and application crash by leveraging an applicati...

CVE-2015-0289

The PKCS7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service NULL pointer dereference and application crash by leveraging an applicati...

Debian Security Advisory DSA 3197-1 (openssl - security update)

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2015-0286 Stephen Henson discovered that the ASN1TYPEcmp function can be crashed, resulting in denial of service...

lib32-openssl: multiple issues

CVE-2015-1787 denial of service If client auth is used then a server can segfault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. - CVE-2015-0207 denial of service The DTLSv1listen...

FreeBSD-SA-15:06.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:06.openssl Security Advisory The FreeBSD Project Topic: Multiple OpenSSL vulnerabilities Category: contrib Module: openssl Announced: 2015-03-19; Last revise...

DSA-3197-1 openssl - security update

Bulletin has no description...

CVE-2015-0289

The PKCS7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service NULL pointer dereference and application crash by leveraging an applicati...

openSUSE Security Update : openssl (openSUSE-SU-2012:0547-1)

The implementation of Cryptographic Message Syntax CMS and PKCS 7 in OpenSSL was vulnerable to a Million Message Attack MMA adaptive chosen ciphertext attack CVE-2012-0884. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Mozilla Network Security Services 'p12creat.c'内存破坏漏洞

Bugtraq ID:66366 CVE ID:CVE-2014-1492 NSS实现SSL v2/v3, TLS, PKCS5, PKCS7, PKCS11, PKCS12, S/MIME, X.509v3证书和其他安全标准。 Network Security Services "secpkcs12newasafe"函数security/nss/lib/pkcs12/p12creat.c存在错误，允许攻击者利用漏洞破坏内存，使应用程序崩溃或执行任意代码。 0 Network Security Services NSS 3.x Network Security Services...

[SECURITY] Fedora 19 Update: nss-3.15.4-1.fc19

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Amazon Linux AMI : openssl (ALAS-2012-62)

A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions S/MIME messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. CVE-2012-1165 A flaw was found in the PKCS7 and...

[SECURITY] Fedora 18 Update: nss-3.14.3-1.fc18

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Fedora Update for nss FEDORA-2013-0271

Check for the Version of nss OpenVAS Vulnerability Test Fedora Update for nss FEDORA-2013-0271 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of t...

Mandriva Update for openssl MDVSA-2012:038 (openssl)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Multiple OpenSSL vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 IBM SECURITY ADVISORY First Issued: Wed Aug 1 09:25:58 CDT 2012 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory4.asc or...

Scientific Linux Security Update : openssl on SL5.x, SL6.x i386/x86_64 (20120327)

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols, as well as a full-strength, general purpose cryptography library. A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions...