4503 matches found
kernel, perf, python security update
CentOS Errata and Security Advisory CESA-2017:0386 An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
kernel: Race condition in packet_set_ring leads to use after free
A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKETV3 ring buffer. A local user able to open a raw packet socket requires the CAPNETRAW...
kernel: Race condition in packet_set_ring leads to use after free
A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKETV3 ring buffer. A local user able to open a raw packet socket requires the CAPNETRAW...
kernel: Race condition in packet_set_ring leads to use after free
A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKETV3 ring buffer. A local user able to open a raw packet socket requires the CAPNETRAW...
DEBIAN-CVE-2017-6346
Race condition in net/packet/afpacket.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service use-after-free or possibly have unspecified other impact via a multithreaded application that makes PACKETFANOUT setsockopt system calls...
SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)
A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...
SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients...
EMC RecoverPoint SSL Stripping Security Bypass Vulnerability
EMC RecoverPoint is a set of disaster recovery and data protection software, EMC RecoverPoint for Virtual Machines VMs is a set of disaster recovery solutions for VMware environments. EMC RecoverPoint SSL Stripping security bypass vulnerability. Allows an attacker to perform a man-in-the-middle...
The vulnerability of the OpenSSH cryptographic protection mechanism, which allows attackers to increase their privileges.
The vulnerability of the sshd component of the OpenSSH cryptographic protection is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder, operating locally, to enhance their privileges by using undefined vectors related to serverloop.c, thereby enabling...
CVE-2016-9244
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer SSL session IDs from other sessions. It is possible...
DEBIAN-CVE-2014-9914
Race condition in the ip4datagramreleasecb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service use-after-free by leveraging incorrect expectations about locking during multithreaded access to internal data structures...
CVE-2014-9914
Race condition in the ip4datagramreleasecb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service use-after-free by leveraging incorrect expectations about locking during multithreaded access to internal data structures...
UBUNTU-CVE-2014-9914
Race condition in the ip4datagramreleasecb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service use-after-free by leveraging incorrect expectations about locking during multithreaded access to internal data structures...
CVE-2014-9914
Race condition in the ip4datagramreleasecb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service use-after-free by leveraging incorrect expectations about locking during multithreaded access to internal data structures...
CVE-2014-9914
Summary of CVE-2014-9914 (Linux kernel) : A race condition in ip4_datagram_release_cb within net/ipv4/datagram.c (kernel before 3.15.2) can be exploited by a local user to gain privileges or cause a denial of service (use-after-free) due to incorrect locking assumptions during multithreaded IPv4 ...
Business LaLa Call App for Android fails to verify SSL server certificates
Overview Business LaLa Call App for Android provided by K-Opticom Corporation fails to verify SSL server certificates. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...
CVE-2014-9914
Race condition in the ip4datagramreleasecb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service use-after-free by leveraging incorrect expectations about locking during multithreaded access to internal data structures...
openssl: Possible integer overflow vulnerabilities in codebase
Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash...
