223 matches found
AIX OpenSSL Denial of Service due to double free and others
IBM SECURITY ADVISORY First Issued: The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssladvisory10.asc https://aix.software.ibm.com/aix/efixes/security/openssladvisory10.asc...
openSUSE Security Update : openssl (openSUSE-SU-2014:1052-1)
This openssl update fixes the following security issues : - openssl 1.0.1i - Information leak in pretty printing functions CVE-2014-3508 - Crash with SRP ciphersuite in Server Hello message CVE-2014-5139 - Race condition in sslparseserverhellotlsext CVE-2014-3509 - Double Free when processing DTL...
CVE-2014-3511
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...
CVE-2014-3511
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...
Design/Logic Flaw
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...
CVE-2014-3511
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...
CVE-2014-3511
CVE-2014-3511 affects OpenSSL 1.0.1 (and related 1.0.0/1.0.1 branches) where the ssl23_get_client_hello path (s23_srvr.c) can be triggered to fragment a ClientHello and force downgrading to TLS 1.0 when both client and server support later TLS versions. This enables a man-in-the-middle to induce ...
openssl security update
1.0.1e-34.4 - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3507 - avoid memory leak in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3509 - fix race condition when parsing serve...
Updated openssl packages fix security vulnerabilities
A flaw in OBJobj2txt may cause pretty printing functions such as X509nameoneline, X509nameprintex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected...
OpenSSL 1.0.1 < 1.0.1i Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.1i. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.1i advisory. - The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service...
DSA-2998-1 openssl - security update
Bulletin has no description...
UBUNTU-CVE-2014-3511
The ssl23getclienthello function in s23srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol...
Debian Security Advisory DSA 2998-1 (openssl - security update)
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service application crash, large memory consumption, information leak, protocol downgrade. Additionally, a buffer overrun affecting only applications explicitly set up for SRP ha...
Debian DSA-2998-1 : openssl - security update
Multiple vulnerabilities have been identified in OpenSSL, a Secure Sockets Layer toolkit, that may result in denial of service application crash, large memory consumption, information leak, protocol downgrade. Additionally, a buffer overrun affecting only applications explicitly set up for SRP ha...
OpenSSL -- multiple vulnerabilities
The OpenSSL Project reports: A flaw in OBJobj2txt may cause pretty printing functions such as X509nameoneline, X509nameprintex et al. to leak some information from the stack. CVE-2014-3508 The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer...
Debian: Security Advisory (DSA-2998-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SA-CONTRIB-2014-035 - CAS Server - Access Bypass
The casserver module of the CAS project implements the CAS 1.0 and 2.0 specifications for providing a single sign-on to relying party web application the "service" in CAS specs. The CAS server creates single-use tickets when serving a user's login request, which is subsequently deleted when the...
Ubuntu: Security Advisory (USN-2091-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 12.04 LTS : libotr vulnerabilities (USN-2091-1)
This update disables the OTR v1 protocol to prevent protocol downgrade attacks. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
