UBUNTU-CVE-2014-3522

The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...

FreeBSD : subversion -- several vulnerabilities (83a418cc-2182-11e4-802c-20cf30e32f6d)

Subversion Project reports : Using the Serf RA layer of Subversion for HTTPS uses the aprfnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, aprfnmatch is not designed for this purpose. Instead it is designed to behave like common shell...

Debian DSA-2994-1 : nss - security update

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library : - CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. - CVE-2013-5606 Certificate validation with the verifylog mode did...

Debian Security Advisory DSA 2994-1 (nss - security update)

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library: CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. CVE-2013-5606 Certificate validation with the verifylog mode did not...

DLA-23-1 nss - security update

Bulletin has no description...

CVE-2014-2783

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

Security feature bypass

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

CVE-2014-2783

CVE-2014-2783 affects Microsoft Internet Explorer 7–11. Description confirms a security feature bypass: IE fails to prevent the use of wildcard EV SSL certificates, enabling remote attackers to spoof a site’s trust level by exploiting an EV certificate issuance issue. Impact described in sources ...

CVE-2014-2783

Microsoft Internet Explorer 7 through 11 does not prevent use of wildcard EV SSL certificates, which might allow remote attackers to spoof a trust level by leveraging improper issuance of a wildcard certificate by a recognized Certification Authority, aka "Extended Validation EV Certificate...

Microsoft Internet Explorer Extended Validation SSL Certificate Security Bypass Vulnerability

Description Microsoft Internet Explorer is prone to a security-bypass vulnerability. An attacker may exploit this issue to bypass EV SSL certificate guidelines by using a wildcard certificate. This may aid in further attacks. Technologies Affected Avaya Aura Conferencing 6.0 SP1 Standard Avaya Au...

Microsoft IIS 4.0/5.0 FTP Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2717/info Due to a flaw in the pattern-matching function used by FTP commands, denial of service attacks can be successfully launched. If a user submits an FTP command along with a filename containing specially placed...

Perception LiteServe 2.0.1 DNS Wildcard Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6131/info A cross site scripting vulnerability has been discovered in Perception LiteServe. It should be noted that this vulnerability is limited to server configurations with Wildcard DNS enabled. It has been reported th...

Microsoft IIS FTP Server <= 7.0 - Stack Exhaustion DoS [MS09-053]

No description provided by source. Exploit Title: MS09-053 Microsoft IIS FTP Server = 7.0 Stack Exhaustion DoS Date: Jul 03, 2011 Updated: Jul 13, 2011 Author: Myo Soe YGN Ethical Hacker Group - http://yehg.net/ Software Link: http://www.microsoft.com/ Version: 5.0 - 7.0 Tested on: unpatched...

rubygem-actionpack: directory traversal issue

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted...

SuSE 11.3 Security Update : curl (SAT Patch Number 9133)

This curl update fixes the following security issues : - wrong re-use of connections. CVE-2014-0138. bnc868627 - IP address wildcard certificate validation. CVE-2014-0139. bnc868629 - --insecure option inappropriately enforcing security safeguard. bnc870444 %NASLMINLEVEL 70300 C Tenable Network...

rubygem-actionpack: directory traversal issue

A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted...

Mozilla Firefox < 29.0 Multiple Vulnerabilities

Binary data 8213.prm...

[BSA-095] Security Update for openssh

Colin Watson uploaded new packages for openssh which fixed the following security problems: CVE-2014-2532 DSA-2894-1 Jann Horn discovered that OpenSSH incorrectly handled wildcards in AcceptEnv lines. A remote attacker could use this issue to trick OpenSSH into accepting any environment variable...

Incorrect IDNA domain name matching for wildcard certificates — Mozilla

Security researcher Christian Heimes reported that the Network Security Services NSS library does not handle IDNA domain prefixes according to RFC 6125 for wildcard certificates. This leads to improper wildcard matching of domains when they should not be matched in compliance with the...

UBUNTU-CVE-2014-0350

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate...