[slackware-security] openssl

New openssl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssl-solibs-1.0.1j-i486-1slack14.1.txz: Upgraded. Security fix...

CVE-2014-3567

Memory leak in the tlsdecryptticket function in t1lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service memory consumption via a crafted session ticket that triggers an integrity-check failure...

Important: openssl

Issue Overview: A memory leak flaw was found in the way OpenSSL parsed the DTLS Secure Real-time Transport Protocol SRTP extension data. A remote attacker could send multiple specially crafted handshake messages to exhaust all available memory of an SSL/TLS or DTLS server. CVE-2014-3513 A memory...

UBUNTU-CVE-2014-3567

Memory leak in the tlsdecryptticket function in t1lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service memory consumption via a crafted session ticket that triggers an integrity-check failure...

DEBIAN-CVE-2014-5351

The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access...

CVE-2014-5351

CVE-2014-5351 affects MIT Kerberos 5 (krb5) kadmind: the kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c sends old keys in response to a -randkey -keepold request, enabling remote authenticated users to forge tickets by leveraging administrative access. Affected: krb5

nss security update

CentOS Errata and Security Advisory CESA-2014:1246 Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Commo...

DEBIAN-CVE-2014-6417

net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via a long unencrypted auth ticket...

DEBIAN-CVE-2014-6416

Buffer overflow in net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service memory corruption and panic or possibly have unspecified other impact via a long unencrypted auth ticket...

CVE-2014-6417

net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via a long unencrypted auth ticket...

Buffer overflow

Buffer overflow in net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service memory corruption and panic or possibly have unspecified other impact via a long unencrypted auth ticket...

CVE-2014-6416

Buffer overflow in net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service memory corruption and panic or possibly have unspecified other impact via a long unencrypted auth ticket...

UBUNTU-CVE-2014-6416

Buffer overflow in net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service memory corruption and panic or possibly have unspecified other impact via a long unencrypted auth ticket...

CVE-2014-6417

net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via a long unencrypted auth ticket...

CVE-2014-6677

The Ticket Round Up aka com.xcr.android.ticketroundupapp application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Ticket Round Up aka com.xcr.android.ticketroundupapp application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6677

The Ticket Round Up aka com.xcr.android.ticketroundupapp application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6677

The CVE-2014-6677 entry applies to The Ticket Round Up (com.xcr.android.ticketroundupapp) on Android, version 3.0.1, where the app does not verify X.509 certificates from SSL servers. This certificate validation failure enables a man-in-the-middle to spoof servers and access sensitive information...

PT-2014-7215 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.16.3 Description: The issue allows remote attackers to cause a denial of service, resulting in memory corruption and panic, or possibly have other unspecified impacts. This is achieved via a long unencrypted...

Information disclosure

The TICKET APP - Concerts & Sports aka com.xcr.android.ticketapp application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...