4503 matches found
DEBIAN-CVE-2016-2177
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service integer overflow and application crash or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3srvr....
openSUSE Security Update : nodejs (openSUSE-2016-715)
This update for nodejs to version 4.4.5 fixes the several issues. These security issues introduced by the bundled openssl were fixed by going to version 1.0.2h : - CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider memory allocation during a certain padding check, which allowed...
The vulnerability of the Mac OS X operating system, which allows a perpetrator to obtain confidential information
The vulnerability of the Tcl component in the Mac OS X operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to obtain confidential information by using SSLv2 support...
Denial of Service Vulnerability in Multiple F5 BIG-IP Products (CNVD-2016-03941)
F5 BIG-IP Analytics and others are products of F5 Corporation in the U.S. F5 BIG-IP Analytics is a suite of Web application performance analytics software. the APM is a suite of solutions that provide secure and unified access to business-critical applications and networks. and the LTM is a local...
Man-in-the-middle attack vulnerabilities in multiple DMM products
DMM FX Trade for Android and others are Android-based applications developed by DMM Securities Inc. of Japan for foreign exchange trade transactions. A security vulnerability exists in several DMM products, which stems from the program's failure to validate SSL server certificates. An attacker...
OracleVM 3.3 : kernel-uek (OVMSA-2016-0053)
The remote OracleVM system is missing necessary patches to address critical security updates : - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. David Howells Orabug: 23279020 CVE-2016-0758 - net: add validation for the socket syscall protocol argument Hannes Frederic...
UBUNTU-CVE-2016-4951
The tipcnlpubldump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a dumpit operation...
Red Hat OpenShift Enterprise STI build process elevation of privilege vulnerability
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. The STI build process in Red Hat OpenShift Enterprise fails to properly restrict access to the STI...
CVE-2016-1853
Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support...
THE HYAKUGO BANK 105 BANK Man-in-the-Middle Attack Vulnerability
THE HYAKUGO BANK 105 BANK is a suite of online banking mobile apps from THE HYAKUGO BANK, Japan. A man-in-the-middle attack vulnerability exists in THE HYAKUGO BANK 105 BANK, which arises from the program failing to properly validate an SSL server certificate. An attacker could use this...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3559)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3559 advisory. - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. David Howells Orabug: 23279022 CVE-2016-0758 - unix: properly account...
openssl security update
CentOS Errata and Security Advisory CESA-2016:0996 An update for openssl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Microsoft .NET Framework TLS/SSL Information Disclosure Vulnerability
Microsoft .NET Framework is a comprehensive and consistent programming model developed by Microsoft Corporation USA and a development platform for building Windows, Windows Store, Windows Phone, Windows Server and Microsoft Azure Windows Store, Windows Phone, Windows Server, and Microsoft Azure...
CVE-2016-0149
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."...
kernel: File descriptors passed over unix sockets are not properly accounted
It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system...
CVE-2016-2094
The HTTPS NIO Connector allows remote attackers to cause a denial of service thread consumption by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability...
Cybozu kintone for Android Validated SSL Server Certificate Vulnerability
Cybozu kintone for Android is an Android-based business cloud application for business communication and collaboration by Cybozu. A security vulnerability exists in Cybozu kintone for Android versions 1.0.0 to 1.0.5, which can be exploited by attackers to conduct man-in-the-middle attacks and...
[SECURITY] Fedora 22 Update: mod_nss-1.0.11-7.fc22
The modnss module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols using the Network Security Services NSS security library...
nss: Use-after-free in NSS during SSL connections in low memory (MFSA 2016-15)
A use-after-free flaw was found in the way NSS handled DHE Diffie–Hellman key exchange and ECDHE Elliptic Curve Diffie-Hellman key exchange handshake messages. A remote attacker could send a specially crafted handshake message that, when parsed by an application linked against NSS, would cause th...