CVE-2016-1223

Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors...

USN-2864-1: NSS vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

Debian DLA-354-1 : nss security update

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2015-7181 The secasn1dparseleaf function improperly restricts access to an unspecified data structure, which...

CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service

More info at https://symfony.com/cve-2015-8125...

Low: Red Hat Security Advisory: sssd security and bug fix update

Updated sssd packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Vulnerability of the Java Platform software platform, which allows attackers to gain access to protected information

The vulnerability of the JGSS sub-component of the Java Platform is related to errors in the code. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information through the use of Java Web Start or Java applets...

South Korea Signs Up to Cyber Theft Pledge

On Friday the Obama administration secured its second win toward establishing a new norm in cyberspace. The Joint Fact Sheet published by the White House includes the following language: "no country should conduct or knowingly support cyber-enabled theft of intellectual property, trade secrets, o...

Gentoo Security Advisory GLSA 201406-19

Gentoo Linux Local Security Checks GLSA 201406-19 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

[SECURITY] [DSA 3336-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3336-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 17, 2015 https://www.debian.org/security/faq -...

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the libnss3-1d package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

'Google VPN' in-built Hidden Service spotted in Android 5.1

Good news for all Android Lollipop-ers! Google appears to be secretly working on a Virtual Private Network VPN service, dubbed 'Google VPN'. The news is still not confirmed, but the folks at Pocketables discovered an interesting hidden app called "Google Connectivity Services" under "All Apps" in...

DSA-3186-1 nss - security update

Bulletin has no description...

Debian Security Advisory DSA 3186-1 (nss - security update)

It was discovered that the Mozilla Network Security Service library nss incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. OpenVAS Vulnerability Test $Id: deb3186.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated...

Oracle Fusion Middleware Security Service Information Disclosure (January 2015 CPU) (BEAST)

The version of Oracle HTTP Server installed on the remote host is affected by an information disclosure vulnerability, known as BEAST, in the SSL 3.0 and TLS 1.0 protocols due to a flaw in the way the initialization vector IV is selected when operating in cipher-block chaining CBC modes. A...

Mulesoft ESB Runtime 3.5.1 Privilege Escalation / Code Execution Vulnerabilities

Mulesoft ESB Runtime version 3.5.1 suffers from an authenticated privilege escalation vulnerability that can lead to remote code execution. Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code Execution Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to...

USN-2361-1: NSS vulnerability

Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this issue to forge RSA certificates...

USN-2350-1 nss update

The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.17 which includes the latest CA certificate bundle...

USN-2350-1: NSS update

The NSS package contained outdated CA certificates. This update refreshes the NSS package to version 3.17 which includes the latest CA certificate bundle...

USN-2343-1 nss vulnerability

Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...