EUVD-2014-3553

Malware in sbrugna...

Updated mbedtls/hiawatha/belle-sip/linphone/pdns packages fix security vulnerability

Note: this package was called polarssl, but is now called mbed tls. The PolarSSL software is now called mbed TLS. Heap-based buffer overflow in mbed TLS formerly PolarSSL 1.3.x before 1.3.14 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code vi...

Heap overflow

Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS formerly PolarSSL 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code via a long hostname to the server name indication SNI...

CVE-2015-5291

Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS formerly PolarSSL 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code via a long hostname to the server name indication SNI...

CVE-2015-5291

CVE-2015-5291 and CVE-2015-8036 describe heap-based buffer overflows in PolarSSL (mbed TLS) that affect PolarSSL 1.x before 1.2.17 and mbed TLS 1.3.x before 1.3.14 and 2.x before 2.1.2. The flaw stems from improper boundary handling of the hostname/SNI extension in ClientHello, enabling remote at...

Null pointer dereference

The sslsetclientdisabled function in t1lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service NULL pointer dereference and client application crash via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite...

CVE-2013-6659

The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/sslclientsocketnss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent...

SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6541)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

CVE-2009-3046: Improper Certificate Validation

Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate...