CVE-2011-0651

CVE-2011-0651 concerns Icon Labs Iconfidant SSL Server prior to 1.3.0, where a buffer overflow in the key exchange path can allow remote code execution. The vulnerability is triggered by a crafted client master key packet in which the sum of unspecified length fields exceeds a certain value, enab...

Icon Labs Iconfidant SSL Server Key Length Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Icon Labs Iconfidant SSL Server. Authentication is not required to exploit this vulnerability. The specific flaw exists in the functionality responsible for key exchange. If the sum of specific...

Design/Logic Flaw

libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, as demonstrated by use of a www.example.con...

SSL Server Certificate Exchange Detection

Binary data 5620.prm...

CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

CVE-2009-4565

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...

jruby-openssl Gem for JRuby fails to do proper certificate validation

A security problem involving peer certificate verification was found where failed verification silently did nothing, making affected applications vulnerable to attackers. Attackers could lead a client application to believe that a secure connection to a rogue SSL server is legitimate. Attackers...

CVE-2009-3942

Technical details about CVE-2009-3942 are not publicly available in the provided connected documents. The materials do not specify affected products, versions, root cause, or remediation. Monitor for updates and new advisories.

Design/Logic Flaw

Certificate Assistant in Apple Mac OS X before 10.6.2 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

SuSE 10 Security Update : neon (ZYPP Patch Number 6548)

neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...

Design/Logic Flaw

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2009-3766

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Mandrake Security Advisory MDVSA-2009:228 (libneon)

The remote host is missing an update to libneon announced via advisory MDVSA-2009:228. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Fedora Core 11 FEDORA-2009-8815 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8815. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora Core 10 FEDORA-2009-8794 (neon)

The remote host is missing an update to neon announced via advisory FEDORA-2009-8794. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Fedora 10 : neon-0.28.6-1.fc10 (2009-8794)

This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...

Fedora 11 : neon-0.28.6-1.fc11 (2009-8815)

This update includes the latest release of neon, version 0.28.6. This fixes two security issues: the 'billion laughs' attack against expat could allow a Denial of Service attack by a malicious server. CVE-2009-2473 an embedded NUL byte in a certificate subject name could allow an undetected MITM...

Mandrake Security Advisory MDVSA-2009:201 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory MDVSA-2009:201. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

CVE-2009-2730

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's 1 Common Name CN or 2 Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued b...