OpenWrt ustream-ssl certificate verification information leak vulnerability

Talos Vulnerability Report TALOS-2019-0893 OpenWrt ustream-ssl certificate verification information leak vulnerability November 15, 2019 CVE Number CVE-2019-5101,CVE-2019-5102 SUMMARY An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and...

PT-2019-6954 · None · Perdition

Name of the Vulnerable Software and Affected Versions: Perdition versions prior to 2.2 Description: The issue is related to weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. Specifically, ssl outgoing ciphers is not being applied to STARTTLS...

OpenWrt ustream-ssl library information disclosure vulnerability

OpenWrt is a Linux operating system for embedded devices. ustream-ssl is one of the cryptographic libraries. The ustream-ssl library in OpenWrt version 18.06.4 and 15.05.1 is vulnerable to an information disclosure vulnerability that can be exploited by an attacker to obtain sensitive information...

evolution security and bug fix update

evolution 3.28.5-9 - Add patch for RH bug 1724984 ECompEditor Ensure attendee changes stored before save 3.28.5-8 - Add patch for RH bug 1724659 Make sure intltool-merge cache is created only once 3.28.5-7 - Add patch for RH bug 1724232 Help Contents F1 has a bad link to GNOME site...

Protect

Multiple integer overflow and out of bounds read/write vulnerabilities in the SSL VPN web-mode SSH client may allow an unauthenticated attacker to cause the SSL VPN user session to break Denial of service and possibly to run arbitrary code via specially crafted packets sent from a malicious SSH...

CVE-2010-4533

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...

CVE-2010-4533

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...

Security feature bypass

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...

CVE-2010-4533

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...

CVE-2010-4533

CVE-2010-4533 affects offlineimap prior to version 6.3.4, where SSL certificate validation was added but SSLv2 is still enabled. This keeps SSLv2’s known weaknesses and yields high CVSS metrics (Confidentiality/Integrity/Availability partial in CVSS2; Critical in CVSS3.1). The connected documents...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

Code injection

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

Removed by vendor...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

CVE-2010-4532 affects offlineimap prior to 6.3.2. The issue is that SSL certificate validation is not performed when the option “ssl = yes” is used, enabling potential man-in-the-middle attacks. This is caused by missing certificate validation in the SSL path of the client. Impact is limited to c...

EulerOS 2.0 SP5 : elinks (EulerOS-SA-2019-2142)

According to the version of the elinks package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.CVE-2012-6709 Note that Tenable Network Security has extracted the...

wolfSSL buffer overflow vulnerability (CNVD-2019-41425)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A buffer overflow vulnerability exists in the DecodedCert structure of GetName in wolfcrypt/src/asn.c file in wolfSSL versions 4.1.0...

[SECURITY] Fedora 29 Update: nss-3.47.0-2.fc29

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...