Oracle: Security Advisory (ELSA-2011-0975)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the iOS operating system, which allows attackers to carry out “man-in-the-middle” attacks

The vulnerability of the WebKit component of the iOS operating system is related to errors in cryptographic transformations. Exploiting this vulnerability allows a remote attacker to perform “man-in-the-middle” attacks due to errors in SSL certificate processing...

UBUNTU-CVE-2015-5262

http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service HTTPS call hang via unspecified vectors...

mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)

It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client an...

Microsoft XML Core Services Man-in-the-Middle Information Disclosure Vulnerability (CNVD-2015-05495)

Microsoft XML Core Services MSXML is a user to allow the use of JScript, VBScript and Visual Studio 6.0 users to develop XML-based applications , in order to interoperate with other applications that follow the XML 1.0 standard . A security vulnerability exists in Microsoft XML Core Services that...

Microsoft Windows WebDAV Man-in-the-Middle Information Disclosure Vulnerability (CNVD-2015-05494)

Microsoft Windows is a popular operating system. A security vulnerability exists in Microsoft Windows WebDAV where the WebDAV client allows SSL 2.0 man-in-the-middle attackers to force the encryption algorithm to downgrade to SSL 2.0 and then decrypt the communication...

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the ssl3writebytes function in the OpenSSL library is related to errors in the code. Exploiting this vulnerability can allow a remote attacker to cause service interruptions due to errors in processing a series of input/output operations...

MS15-084: Description of the security update for Windows XML core services: August 11, 2015

None None...

MS15-084: Vulnerabilities in XML core services could allow information disclosure: August 11, 2015

Resolves vulnerabilities in Windows and Office that could allow information disclosure by either exposing memory addresses if a user clicks a specially crafted link or by explicitly allowing the use of Secure Sockets Layer SSL 2.0.Summary This security update resolves vulnerabilities in Microsoft...

389-ds-base: nsSSL3Ciphers preference not enforced server side (regression)

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

Rugged Operating System (ROS) SSL 3.0 Protocol Downgrade SSL Decryption Vulnerability

RuggedCom Inc RuggedCom Inc is the world's leading manufacturer of high performance networking and communications equipment for use in industrial environments. A security vulnerability in the Rugged Operating System ROS allows an attacker to decrypt communications using a man-in-the-middle attack...

wireshark: TLS/SSL decryption crash (wnpa-sec-2015-05)

Buffer underflow in the ssldecryptrecord function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service application crash via a crafted packet that is improperly handled during decryption of an SSL...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

SSL/TLS: "Invariance Weakness" vulnerability in RC4 stream cipher

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic...

The vulnerability of the Ubuntu operating system, which allows a hacker to trigger a service failure

The vulnerability of the Ubuntu operating system is related to a memory reclamation error. Exploiting this vulnerability allows an attacker, operating remotely, to cause a service failure by closing the SSL session at a certain time...