Design/Logic Flaw

muttssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

CVE-2009-3765

muttssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

CVE-2009-3765

CVE-2009-3765 affects mutt (versions 1.5.19/1.5.20) when built with OpenSSL: it mishandles a '\0' in the domain name of the X.509 certificate’s CN, enabling MITM spoofing of SSL servers via certificates from a legitimate CA. The vulnerability is described as related to CVE-2009-2408. The provided...

CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

DSA-1916-1 kdelibs - SSL certificate verification weakness

Bulletin has no description...

Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30

Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30 ------------------------------------------------------------- October 21st, 2009 ======= Summary ======= Name: Anonymous Remote Arbitrary Code Execution in Alien Arena 7.30 Release Date: October 21st, 2009 Discoverer: Jason Geffner...

SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6541)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

Shibboleth Service Provider NULL Character Spoofing Vulnerability (Windows)

The host has Shibboleth Service Provider installed and is prone to NULL Character Spoofing vulnerability. OpenVAS Vulnerability Test $Id: gbshibbolethspnullcharspoofingvulnwin.nasl 4869 2016-12-29 11:01:45Z teissa $ Shibboleth Service Provider NULL Character Spoofing Vulnerability Windows Authors...

CA Products Message Engine RPC Server Opcode 43 Buffer Overflow (CVE-2006-5143)

Computer Associates CA BrightStor ARCserve Backup and Business Protection Suite families of software products offer data protection for distributed servers, clients, databases and applications. They provide centralized control over a series of distribution operations including Backup and Restore,...

CVE-2009-2510

The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a '\0' character in a domai...

Integer overflow

Integer overflow in the CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows man-in-the-middle attackers to spoof arbitrary SSL servers and other entities v...

Sql injection

The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a '\0' character in a domai...

CA BrightStor ARCserve Backup Message Engine Opcode 47 Buffer Overflow (CVE-2007-0169)

Computer Associates BrightStor ARCserve Backup and Business Protection Suite families of software products offer data protection for distributed servers, clients, databases and applications. They provide centralized control over a series of distributed operations including backup and restore, dat...

Apache 2.2.x < 2.2.14 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.14. It is, therefore, potentially affected by multiple vulnerabilities : - Faulty error handling in the Solaris pollset support could lead to a denial of service. CVE-2009-2699 - The 'modproxyftp' modu...

Microsoft IE CA SSL Certificate Security Bypass Vulnerability (Oct 2009)

Internet Explorer is prone to a security bypass vulnerability. This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

ProFTP welcome message buffer overflow

Added: 10/01/2009 BID: 36128 OSVDB: 57394 Background Labtam ProFTP is an FTP client program for Microsoft Windows. Problem A buffer overflow vulnerability allows command execution when a user connects to an FTP server which sends a specially crafted welcome message. Resolution Apply a fix from th...

nginx HTTP Request Remote Buffer Overflow Vulnerability

nginx is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

ProFTP welcome message buffer overflow

Added: 10/01/2009 BID: 36128 OSVDB: 57394 Background Labtam ProFTP is an FTP client program for Microsoft Windows. Problem A buffer overflow vulnerability allows command execution when a user connects to an FTP server which sends a specially crafted welcome message. Resolution Apply a fix from th...

CVE-2009-3490

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...