258 matches found
OpenSSL Releases Patch for POODLE Attack
The OpenSSL Project has released a new version of the encryption software, which patches several security flaws, including the bug that is exploited by the POODLE attack on SSLv3. The updated versions of OpenSSL come just a couple of days after a trio of researchers at Google revealed the POODLE...
DSA-3053-1 openssl - security update
Bulletin has no description...
Amazon Linux AMI : openssl (ALAS-2014-427)
A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol SRTP extension data. A remote attacker could send multiple specially crafted handshake messages to exhaust all available memory of an SSL/TLS or DTLS server. CVE-2014-3513 A memory leak flaw was...
Debian Security Advisory DSA 3053-1 (openssl - security update)
Several vulnerabilities have been found in OpenSSL, the Secure Sockets Layer library and toolkit. CVE-2014-3513 A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol SRTP extension data. A remote attacker could send multiple specially crafted handshak...
[slackware-security] openssl
New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssl-solibs-1.0.1j-i486-1slack14.1.txz: Upgraded. Security fix...
Vulnerability in OpenSSL - SRTP Memory Leak
A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server...
CVE-2014-3513
Memory leak in d1srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service memory consumption via a crafted handshake message...
UBUNTU-CVE-2014-3513
Memory leak in d1srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service memory consumption via a crafted handshake message...
Important: openssl
Issue Overview: A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol SRTP extension data. A remote attacker could send multiple specially crafted handshake messages to exhaust all available memory of an SSL/TLS or DTLS server. CVE-2014-3513 A memory...
PT-2014-1703
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 through 1.0.1j Description The issue is related to a memory leak in the DTLS SRTP extension in OpenSSL, which can be exploited by remote attackers to cause a denial of service due to excessive memory consumption. This ca...
openSUSE Security Update : srtp (openSUSE-SU-2014:1250-1)
srtp was updated to fix a buffer overflow flaw that allowed remote attackers to cause a denial of service crash via vectors related to a length inconsistency in the cryptopolicysetfromprofileforrtp and srtpprotect functions. CVE-2013-2139. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
openSUSE Security Update : srtp (openSUSE-SU-2013:1258-1)
A buffer overflow in srtp was fixed which could potentially be used by attackers to crash srtp using applications and potentially execute code CVE-2013-2139, bnc828009. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
CVE-2014-2907
The srtpaddaddress function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service application crash via a crafted packet...
UBUNTU-CVE-2014-2907
The srtpaddaddress function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service application crash via a crafted packet...
CVE-2014-2907
The srtpaddaddress function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service application crash via a crafted packet...
CVE-2014-2907
Wireshark 1.10.x before 1.10.7 is affected. The srtp_add_address function in epan/dissectors/packet-rtp.c does not properly update SRTP conversation data, allowing remote attackers to cause a denial of service (application crash) via a crafted RTP packet. Remediation: upgrade to Wireshark 1.10.7 ...
PT-2014-1764
Name of the Vulnerable Software and Affected Versions Wireshark versions 1.10.x through 1.10.6 Description The issue exists in the srtp add address function in the RTP dissector due to incorrect updating of SRTP conversation data. This allows remote attackers to cause a denial of service, resulti...
PhonerLite 2.14 SIP Soft Phone - SIP Digest Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I. Advisory Summary Title: SIP Digest Leak Information Disclosure in PhonerLite 2.14 SIP Soft Phone Date Published: March 30, 2014 Vendors contacted: Heiko Sommerfeldt, PhonerLite author Discovered by: Jason Ostrom Severity: Medium II. Vulnerability...
Buffer overflow
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service crash via vectors related to a length inconsistency in the cryptopolicysetfromprofileforrtp and srtpprotect functions...