Medium: openssl

Issue Overview: A NULL pointer derefernce flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacked could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication. CVE-2015-3194...

openssl security update

1.0.1e-51.1 - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter - fix CVE-2015-3195 - X509ATTRIBUTE memory leak - fix CVE-2015-3196 - race condition when handling PSK identity hint 1.0.1e-51 - fix the CVE-2015-1791 fix broken server side renegotiation 1.0.1e-50 - improved fi...

SUSE-SU-2015:2251-1 Security update for compat-openssl097g

This update for compat-openssl097g fixes the following issues: Security issue fixed: - CVE-2015-3195: When presented with a malformed X509ATTRIBUTE structure OpenSSL would leak memory. This structure is used by the PKCS7 and CMS routines so any application which reads PKCS7 or CMS data from...

OpenSSL 1.0.1 < 1.0.1q Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.1q. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1q advisory. - The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, a...

OpenSSL 1.0.2 < 1.0.2e Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2e. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2e advisory. - The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, a...

OpenSSL 1.0.0 < 1.0.0t Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.0t. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.0t advisory. - ssl/s3clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client,...

CVE-2015-3195

The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by...

Information disclosure

The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by...

CVE-2015-3195

The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by...

FreeBSD-SA-15:26.openssl

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-15:26.openssl Security Advisory The FreeBSD Project Topic: Multiple OpenSSL vulnerabilities Category: contrib Module: openssl Announced: 2015-12-05 Affects: All...

openssl lib32-openssl: multiple issues

CVE-2015-3193 insecure private key in connection with DHE There is a carry propagating bug in the x8664 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not...

Debian DLA-358-1 : openssl security update

When presented with a malformed X509ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS7 and CMS routines so any application which reads PKCS7 or CMS data from untrusted sources is affected. SSL/TLS is not affected. Kurt NOTE: Tenable Network Security has extracted th...

[SECURITY] [DLA 358-1] openssl security update

Package : openssl Version : 0.9.8o-4squeeze22 CVE ID : CVE-2015-3195 When presented with a malformed X509ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS7 and CMS routines so any application which reads PKCS7 or CMS data from untrusted sources is affected. SSL/TLS ...

UBUNTU-CVE-2015-3195

The ASN1TFLGCOMBINE implementation in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by...

DLA-358-1 openssl - security update

Bulletin has no description...

Vulnerability in OpenSSL - X509_ATTRIBUTE memory leak

When presented with a malformed X509ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS7 and CMS routines so any application which reads PKCS7 or CMS data from untrusted sources is affected. SSL/TLS is not affected. Found by Adam Langley Google/BoringSSL using libFuzz...

OpenSSL Multiple Vulnerabilities (20150611 - 2) - Windows

OpenSSL is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl"; ifdescription...

OpenSSL Multiple Vulnerabilities (20150319 - 3) - Windows

OpenSSL is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl"; ifdescription...

Use Padding Oracle attacks to obtain the encrypted key-vulnerability warning-the black bar safety net

0×0 0 Preface In this article I want to share some of the use of the padding oracle vulnerability practical tips, this type of vulnerability allows an attacker to decrypt the ciphertext and the encrypted plaintext. About the padding oracle attack concept and the working principle of the more...

[SECURITY] Fedora 22 Update: nss-3.20.1-1.0.fc22

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...