jetlib.sec » Tags » openssl

Feeds

133444 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

272 items tagged "openssl"

Related tags: stapling [+], ocsp [+], red [+], modification [+], dsa [+], cryptographic message syntax [+], pkcs 7 [+], padding [+], mac check [+], mac [+], key exchange [+], implementation [+], freebsd security [+], freebsd [+], free memory [+], exchange [+], evp [+], decryption [+], cve [+], cms [+], routine security [+], php [+], openssl library [+], internal [+], extension [+], certificate verification [+], certificate [+], zlib [+], protocol implementation [+], null pointer dereference [+], message [+], memory leak [+], kssl [+], function [+], cryptographic [+], compression [+], bio [+], vulnerability [+], denial of service [+], verifyfinal [+], value security [+], usn [+], tls extension [+], target memory [+], signature verification [+], service [+], server gated cryptography [+], scanner [+], private keys [+], pkey [+], passe partout [+], passe [+], partout [+], null pointer [+], multipurpose internet mail extensions [+], multipurpose internet mail [+], mime header [+], mime [+], mandriva [+], linux security [+], linux [+], invalid parameters [+], flaw [+], fix [+], elliptic curve cryptography [+], digital signature algorithm [+], denial of service attack [+], ciphers [+], certificate revocation list [+], buffer overrun [+], buffer overflow [+], athena ssl [+], athena [+], apache http server [+], security [+], service vulnerability [+], x 509 [+], usa [+], ssl3 [+], scripts [+], safer use [+], rsa public keys [+], rpsa [+], rng [+], private [+], predictable [+], pake [+], packets [+], memory [+], maximiliano [+], luciano bello maximiliano bertacchini [+], issue [+], information disclosure vulnerability [+], hp ux [+], header [+], exploits [+], exchange function [+], ecdh [+], ecc [+], corruption [+], ciphersuites [+], black hat [+], transport layer security [+], secure sockets layer [+], ssl [+], ciphersuite [+], memory corruption [+], asn [+], vmsa [+], video [+], update [+], txt [+], tar gz [+], tar [+], suse security [+], squash [+], security announcement [+], security advisory [+], secunia [+], os cos [+], ntp [+], memory access [+], j pake [+], information disclosure [+], hoagie [+], exploit [+], denial [+], cos [+], changecipherspec [+], bug [+], audio [+], announcement [+], advisory [+], security weakness [+], downgrade [+], layer [+], tls [+], server extension [+], server [+], remote [+], bugtraq [+], toolkit [+], openssl toolkit [+], mandriva linux [+], wexpend [+], tls server [+], mdvsa [+], error [+], buffer overflow vulnerability [+], handshake message [+], encoded [+], dtls [+], security vulnerability [+], record [+], fragment [+], cipher [+], ssl key, signature forgery, server certificate, read, previous versions, power fluctuations, pkcs, mysql, multiple, cryptography, cryptographic algorithm, crack, boffins

• May 25, 2012
• 0:00

  Vuln: OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• May 18, 2012
• 8:06

  Bugtraq: [SECURITY] [DSA 2475-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2475-1] openssl security update

  Tags:  security dsa openssl  

• 0:00

  Vuln: OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• May 17, 2012
• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• 0:00

  Vuln: OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption  

• May 16, 2012
• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• May 15, 2012
• 0:00

  Vuln: OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-2333 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• May 11, 2012
• 0:00

  Vuln: OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption  

• May 09, 2012
• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• 0:00

  Vuln: OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

  Tags:  memory-corruption asn openssl  

• May 07, 2012
• 0:00

  Vuln: OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption  

• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• May 03, 2012
• 16:13

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Advisories
  FreeBSD Security Advisory - OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records when operating as a client or a server that accept SSL 3.0 handshakes. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory. OpenSSL support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. Various other OpenSSL issues have also been addressed.

  Tags:  openssl freebsd ssl freebsd-security denial-of-service-attack denial-of-service  

• 16:13

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Recent Files
  FreeBSD Security Advisory - OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records when operating as a client or a server that accept SSL 3.0 handshakes. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory. OpenSSL support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. Various other OpenSSL issues have also been addressed.

  Tags:  openssl freebsd ssl freebsd-security denial-of-service-attack denial-of-service  

• 16:13

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Misc. Files
  FreeBSD Security Advisory - OpenSSL fails to clear the bytes used as block cipher padding in SSL 3.0 records when operating as a client or a server that accept SSL 3.0 handshakes. As a result, in each record, up to 15 bytes of uninitialized memory may be sent, encrypted, to the SSL peer. This could include sensitive contents of previously freed memory. OpenSSL support for handshake restarts for server gated cryptography (SGC) can be used in a denial-of-service attack. Various other OpenSSL issues have also been addressed.

  Tags:  openssl freebsd ssl freebsd-security denial-of-service-attack denial-of-service  

• April 30, 2012
• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• April 26, 2012
• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• April 25, 2012
• 11:31

  Red Hat Security Advisory 2012-0522-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0522-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 data from BIO inputs. Specially-crafted DER encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.

  Tags:  openssl red security transport-layer-security secure-sockets-layer openssl-library  

• 11:31

  Red Hat Security Advisory 2012-0522-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0522-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 data from BIO inputs. Specially-crafted DER encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.

  Tags:  openssl red security transport-layer-security secure-sockets-layer openssl-library  

• 11:31

  Red Hat Security Advisory 2012-0522-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0522-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 data from BIO inputs. Specially-crafted DER encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.

  Tags:  openssl red security transport-layer-security secure-sockets-layer openssl-library  

• 11:07

  Bugtraq: [SECURITY] [DSA 2454-2] openssl incomplete fix

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2454-2] openssl incomplete fix

  Tags:  security dsa openssl  

• April 24, 2012
• 19:08

  Red Hat Security Advisory 2012-0518-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0518-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 data from BIO inputs. Specially-crafted DER encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.

  Tags:  openssl red security transport-layer-security secure-sockets-layer openssl-library  

• 19:08

  Red Hat Security Advisory 2012-0518-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0518-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 data from BIO inputs. Specially-crafted DER encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.

  Tags:  openssl red security transport-layer-security secure-sockets-layer openssl-library  

• 12:22

  OpenSSL ASN1 BIO Incomplete Fix

   » ‎ Packet Storm Security Advisories
  It was discovered that the fix for CVE-2012-2110 released on 19 Apr 2012 was not sufficient to correct the issue for OpenSSL 0.9.8.

  Tags:  fix asn openssl  

• 12:22

  OpenSSL ASN1 BIO Incomplete Fix

   » ‎ Packet Storm Security Recent Files
  It was discovered that the fix for CVE-2012-2110 released on 19 Apr 2012 was not sufficient to correct the issue for OpenSSL 0.9.8.

  Tags:  fix asn openssl  

• 12:22

  OpenSSL ASN1 BIO Incomplete Fix

   » ‎ Packet Storm Security Misc. Files
  It was discovered that the fix for CVE-2012-2110 released on 19 Apr 2012 was not sufficient to correct the issue for OpenSSL 0.9.8.

  Tags:  fix asn openssl  

• 8:08

  Bugtraq: [ MDVSA-2012:064 ] openssl0.9.8

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2012:064 ] openssl0.9.8

  Tags:  bugtraq mdvsa openssl  

• 0:00

  Vuln: OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CVE-2012-2131 Encoded ASN.1 Data Incomplete Fix Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption  

• April 21, 2012
• 14:00

  [remote exploits] - OpenSSL 1.0.1 ASN1 BIO Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - OpenSSL 1.0.1 ASN1 BIO Vulnerability

  Tags:  asn openssl bio exploits vulnerability  

• 14:00

  [remote exploits] - OpenSSL 1.0.1 Memory Corruption

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - OpenSSL 1.0.1 Memory Corruption

  Tags:  exploit remote openssl memory-corruption exploits  

• April 20, 2012
• 12:02

  Bugtraq: [SECURITY] [DSA 2454-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2454-1] openssl security update

  Tags:  security dsa openssl  

• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• April 19, 2012
• 23:52

  OpenSSL Toolkit 1.0.1a

   » ‎ Packet Storm Security Recent Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 23:52

  OpenSSL Toolkit 1.0.1a

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 23:51

  OpenSSL ASN1 BIO Vulnerability

   » ‎ Packet Storm Security Advisories
  A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio. Affected users should upgrade to OpenSSL 1.0.1a, 1.0.0i or 0.9.8v.

  Tags:  asn openssl bio vulnerability  

• 23:51

  OpenSSL ASN1 BIO Vulnerability

   » ‎ Packet Storm Security Recent Files
  A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio. Affected users should upgrade to OpenSSL 1.0.1a, 1.0.0i or 0.9.8v.

  Tags:  asn openssl bio vulnerability  

• 23:51

  OpenSSL ASN1 BIO Vulnerability

   » ‎ Packet Storm Security Misc. Files
  A potentially exploitable vulnerability has been discovered in the OpenSSL function asn1_d2i_read_bio. Affected users should upgrade to OpenSSL 1.0.1a, 1.0.0i or 0.9.8v.

  Tags:  asn openssl bio vulnerability  

• 16:22

  OpenSSL Memory Corruption

   » ‎ Packet Storm Security Recent Files
  OpenSSL versions up to and including 1.0.1 are affected by a memory corruption vulnerability. asn1_d2i_read_bio in OpenSSL contains multiple integer errors that can cause memory corruption when parsing encoded ASN.1 data. This error can be exploited on systems that parse untrusted data, such as X.509 certificates or RSA public keys.

  Tags:  corruption openssl memory rsa-public-keys memory-corruption x-509  

• 16:22

  OpenSSL Memory Corruption

   » ‎ Packet Storm Security Misc. Files
  OpenSSL versions up to and including 1.0.1 are affected by a memory corruption vulnerability. asn1_d2i_read_bio in OpenSSL contains multiple integer errors that can cause memory corruption when parsing encoded ASN.1 data. This error can be exploited on systems that parse untrusted data, such as X.509 certificates or RSA public keys.

  Tags:  corruption openssl memory rsa-public-keys memory-corruption x-509  

• 12:00

  Bugtraq: [ MDVSA-2012:060 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2012:060 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 0:00

  Vuln: OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Encoded ASN.1 Data Integer Truncation Memory Corruption Vulnerability

  Tags:  asn encoded openssl memory-corruption vulnerability  

• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• April 12, 2012
• 0:00

  Vuln: OpenSSL S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

  Tags:  mime openssl header service-vulnerability mime-header null-pointer  

• April 11, 2012
• 0:00

  Vuln: OpenSSL S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

  Tags:  mime openssl header service-vulnerability mime-header null-pointer  

• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• April 03, 2012
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• March 28, 2012
• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• March 27, 2012
• 19:05

  Red Hat Security Advisory 2012-0426-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0426-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. A flaw was found in the PKCS#7 and Cryptographic Message Syntax implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times.

  Tags:  openssl flaw security cryptographic-message-syntax multipurpose-internet-mail-extensions multipurpose-internet-mail  

• 19:05

  Red Hat Security Advisory 2012-0426-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0426-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. A flaw was found in the PKCS#7 and Cryptographic Message Syntax implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times.

  Tags:  openssl flaw security cryptographic-message-syntax multipurpose-internet-mail-extensions multipurpose-internet-mail  

• 19:05

  Red Hat Security Advisory 2012-0426-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0426-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. A NULL pointer dereference flaw was found in the way OpenSSL parsed Secure/Multipurpose Internet Mail Extensions messages. An attacker could use this flaw to crash an application that uses OpenSSL to decrypt or verify S/MIME messages. A flaw was found in the PKCS#7 and Cryptographic Message Syntax implementations in OpenSSL. An attacker could possibly use this flaw to perform a Bleichenbacher attack to decrypt an encrypted CMS, PKCS#7, or S/MIME message by sending a large number of chosen ciphertext messages to a service using OpenSSL and measuring error response times.

  Tags:  openssl flaw security cryptographic-message-syntax multipurpose-internet-mail-extensions multipurpose-internet-mail  

• 9:00

  Bugtraq: [ MDVSA-2012:038 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2012:038 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 0:00

  Vuln: OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL CMS PKCS #7 Decryption CVE-2012-0884 Security Bypass Vulnerability

  Tags:  openssl security cms pkcs-7 decryption  

• March 21, 2012
• 0:00

  Vuln: OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• March 14, 2012
• 20:26

  OpenSSL Toolkit 1.0.1

   » ‎ Packet Storm Security Recent Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 20:26

  OpenSSL Toolkit 1.0.1

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• March 06, 2012
• 0:00

  Vuln: OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• March 01, 2012
• 0:00

  Vuln: OpenSSL ASN.1 S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ASN.1 S/MIME Header Processing Null Pointer Dereference Denial Of Service Vulnerability

  Tags:  mime asn openssl service-vulnerability mime-header null-pointer  

• February 09, 2012
• 0:00

  Vuln: OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS CVE-2012-0050 Remote Denial of Service Vulnerability

  Tags:  dtls openssl remote service-vulnerability denial-of-service cve  

• 0:00

  Vuln: OpenSSL ECC Private Key Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ECC Private Key Information Disclosure Vulnerability

  Tags:  private openssl ecc information-disclosure-vulnerability  

• February 07, 2012
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• February 02, 2012
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• February 01, 2012
• 17:22

  Red Hat Security Advisory 2012-0086-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0086-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake.

  Tags:  openssl ssl security transport-layer-security server-gated-cryptography secure-sockets-layer  

• 17:22

  Red Hat Security Advisory 2012-0086-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0086-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake.

  Tags:  openssl ssl security transport-layer-security server-gated-cryptography secure-sockets-layer  

• 17:22

  Red Hat Security Advisory 2012-0086-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0086-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake.

  Tags:  openssl ssl security transport-layer-security server-gated-cryptography secure-sockets-layer  

• January 24, 2012
• 15:59

  Red Hat Security Advisory 2012-0060-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0060-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. A double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially-crafted policy extension data.

  Tags:  openssl security layer transport-layer-security secure-sockets-layer protocol-implementation  

• 15:59

  Red Hat Security Advisory 2012-0060-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0060-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. A double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially-crafted policy extension data.

  Tags:  openssl security layer transport-layer-security secure-sockets-layer protocol-implementation  

• 15:58

  Red Hat Security Advisory 2012-0059-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0059-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection.

  Tags:  openssl ssl security transport-layer-security secure-sockets-layer protocol-implementation  

• 15:58

  Red Hat Security Advisory 2012-0059-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0059-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. It was discovered that the Datagram Transport Layer Security protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection.

  Tags:  openssl ssl security transport-layer-security secure-sockets-layer protocol-implementation  

• January 23, 2012
• 13:00

  Bugtraq: [SECURITY] [DSA 2392-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2392-1] openssl security update

  Tags:  security dsa openssl  

• January 19, 2012
• 15:51

  OpenSSL Toolkit 1.0.0g

   » ‎ Packet Storm Security Recent Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 15:51

  OpenSSL Toolkit 1.0.0g

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• January 16, 2012
• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-007

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2012-007 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service via crafted data from a TLS client. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux invalid-parameters mac-check  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• 17:20

  Mandriva Linux Security Advisory 2012-006

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2012-006 - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check. The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. The Server Gated Cryptography implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors. The updated packages have been patched to correct these issues.

  Tags:  padding openssl implementation mac mandriva-linux mac-check linux-security  

• 14:00

  Bugtraq: [ MDVSA-2012:006 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2012:006 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 14:00

  Bugtraq: [ MDVSA-2012:007 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2012:007 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 8:00

  Bugtraq: [SECURITY] [DSA 2390-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2390-1] openssl security update

  Tags:  security dsa openssl  

• 0:00

  Vuln: OpenSSL ECC Private Key Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ECC Private Key Information Disclosure Vulnerability

  Tags:  private openssl ecc information-disclosure-vulnerability  

• January 06, 2012
• 16:31

  OpenSSL Toolkit 1.0.0f

   » ‎ Packet Storm Security Tools
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 16:31

  OpenSSL Toolkit 1.0.0f

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 5:33

  SUSE Security Announcement - OpenSSL Update

   » ‎ Packet Storm Security Advisories
  SUSE Security Announcement - This is the SUSE-SU-403 Forbidden-1 security update for OpenSSL. This update improves the ClientHello handshake message parsing function. Prior to this update is was possible that this function reads beyond the end of a message leading to invalid memory access and a crash. Under some circumstances it was possible that information from the OCSP extensions was disclosed.

  Tags:  announcement openssl update suse-security handshake-message security-announcement memory-access  

• December 20, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• December 16, 2011
• 0:00

  Vuln: OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

  Tags:  certificate internal openssl routine-security certificate-verification vulnerability  

• 0:00

  Vuln: OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

  Tags:  ecdh openssl ciphersuites service-vulnerability denial-of-service  

• December 13, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• November 21, 2011
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• November 14, 2011
• 14:00

  Bugtraq: [ MDVSA-2011:173 ] openssl0.9.8

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2011:173 ] openssl0.9.8

  Tags:  bugtraq mdvsa openssl  

• November 09, 2011
• 14:00

  Bugtraq: [SECURITY] [DSA 2343-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2343-1] openssl security update

  Tags:  security dsa openssl  

• November 05, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 04, 2011
• 0:00

  Vuln: PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

  Tags:  openssl php extension denial-of-service  

• November 03, 2011
• 0:00

  Vuln: PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

  Tags:  openssl php extension denial-of-service  

• 0:00

  Vuln: OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

  Tags:  certificate internal openssl routine-security certificate-verification vulnerability  

• October 28, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• October 27, 2011
• 0:00

  Vuln: OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

  Tags:  certificate internal openssl routine-security certificate-verification vulnerability  

• October 26, 2011
• 11:01

  Red Hat Security Advisory 2011-1409-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2011-1409-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An uninitialized variable use flaw was found in OpenSSL. This flaw could cause an application using the OpenSSL Certificate Revocation List checking functionality to incorrectly accept a CRL that has a nextUpdate date in the past. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

  Tags:  openssl red security transport-layer-security certificate-revocation-list secure-sockets-layer  

• 11:01

  Red Hat Security Advisory 2011-1409-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2011-1409-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An uninitialized variable use flaw was found in OpenSSL. This flaw could cause an application using the OpenSSL Certificate Revocation List checking functionality to incorrectly accept a CRL that has a nextUpdate date in the past. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

  Tags:  openssl red security transport-layer-security certificate-revocation-list secure-sockets-layer  

• 11:01

  Red Hat Security Advisory 2011-1409-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2011-1409-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An uninitialized variable use flaw was found in OpenSSL. This flaw could cause an application using the OpenSSL Certificate Revocation List checking functionality to incorrectly accept a CRL that has a nextUpdate date in the past. All OpenSSL users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

  Tags:  openssl red security transport-layer-security certificate-revocation-list secure-sockets-layer  

• 0:00

  Vuln: OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

  Tags:  certificate internal openssl routine-security certificate-verification vulnerability  

• September 28, 2011
• 15:46

  Mandriva Linux Security Advisory 2011-137

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-137 - The elliptic curve cryptography subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation. crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service via out-of-order messages that violate the TLS protocol.

  Tags:  mandriva openssl linux elliptic-curve-cryptography digital-signature-algorithm mandriva-linux  

• 15:46

  Mandriva Linux Security Advisory 2011-137

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-137 - The elliptic curve cryptography subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation. crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service via out-of-order messages that violate the TLS protocol.

  Tags:  mandriva openssl linux elliptic-curve-cryptography digital-signature-algorithm mandriva-linux  

• 15:46

  Mandriva Linux Security Advisory 2011-137

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-137 - The elliptic curve cryptography subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation. crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service via out-of-order messages that violate the TLS protocol.

  Tags:  mandriva openssl linux elliptic-curve-cryptography digital-signature-algorithm mandriva-linux  

• 14:01

  Bugtraq: [ MDVSA-2011:136 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2011:136 ] openssl

  Tags:  bugtraq mdvsa openssl  

• September 15, 2011
• 0:00

  Vuln: OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL ECDH Ciphersuites Remote Denial of Service Vulnerability

  Tags:  ecdh openssl ciphersuites service-vulnerability denial-of-service  

• September 14, 2011
• 9:00

  Bugtraq: [SECURITY] [DSA 2309-1] openssl security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2309-1] openssl security update

  Tags:  security dsa openssl  

• September 12, 2011
• 0:00

  Vuln: OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Internal Certificate Verification Routine Security Bypass Vulnerability

  Tags:  certificate internal openssl routine-security certificate-verification vulnerability  

• September 07, 2011
• 7:40

  OpenSSL Toolkit 1.0.0e

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• August 15, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• August 05, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• July 07, 2011
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• June 23, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• May 16, 2011
• 22:13

  Secunia Security Advisory 44572

   » ‎ Packet Storm Security Advisories
  Secunia Security Advisory - A weakness has been reported in OpenSSL, which can be exploited by malicious people to disclose potentially sensitive information.

  Tags:  advisory secunia security security-advisory openssl  

• May 12, 2011
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• May 09, 2011
• 0:00

  Vuln: OpenSSL J-PAKE Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL J-PAKE Security Bypass Vulnerability

  Tags:  openssl j-pake security pake vulnerability  

• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• May 05, 2011
• 0:00

  Vuln: PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

  Tags:  openssl php extension denial-of-service  

• May 02, 2011
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• April 29, 2011
• 0:00

  Vuln: PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

  Tags:  openssl php extension denial-of-service  

• April 28, 2011
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• April 20, 2011
• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  openssl stapling ocsp handshake-message security-vulnerability  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• April 11, 2011
• 15:00

  Bugtraq: rPSA-2011-0013-1 openssl openssl-scripts

   » ‎ SecurityFocus Vulnerabilities
  rPSA-2011-0013-1 openssl openssl-scripts

  Tags:  bugtraq rpsa openssl scripts  

• March 23, 2011
• 0:00

  Vuln: PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  PHP 'OpenSSL' Extension Multiple Denial of Service Vulnerabilities

  Tags:  openssl php extension denial-of-service  

• March 09, 2011
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• February 15, 2011
• 11:00

  Bugtraq: [ MDVSA-2011:028 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2011:028 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 0:00

  Vuln: OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL OCSP Stapling 'ClientHello' Handshake Message Parsing Security Vulnerability

  Tags:  handshake-message security-vulnerability openssl  

• February 11, 2011
• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• February 10, 2011
• 9:01

  OpenSSL Toolkit 1.0.0d

   » ‎ Packet Storm Security Recent Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 9:01

  OpenSSL Toolkit 1.0.0d

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• February 02, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• January 20, 2011
• 0:00

  Vuln: OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

  Tags:  evp openssl verifyfinal signature-verification vulnerability  

• January 13, 2011
• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• January 11, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• January 10, 2011
• 7:01

  Passe Partout 0.1

   » ‎ Packet Storm Security Recent Files
  passe-partout can be used to extract RSA and DSA private keys from any process linked with OpenSSL. The target memory is scanned to lookup specific OpenSSL patterns.

  Tags:  partout openssl passe target-memory private-keys passe-partout  

• 7:01

  Passe Partout 0.1

   » ‎ Packet Storm Security Tools
  passe-partout can be used to extract RSA and DSA private keys from any process linked with OpenSSL. The target memory is scanned to lookup specific OpenSSL patterns.

  Tags:  partout openssl passe target-memory private-keys passe-partout  

• 7:01

  Passe Partout 0.1

   » ‎ Packet Storm Security Misc. Files
  passe-partout can be used to extract RSA and DSA private keys from any process linked with OpenSSL. The target memory is scanned to lookup specific OpenSSL patterns.

  Tags:  partout openssl passe target-memory private-keys passe-partout  

• January 06, 2011
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• January 05, 2011
• 14:12

  Athena SSL Cipher Scanner 0.6.2

   » ‎ Packet Storm Security Recent Files
  Athena is a SSL cipher scanner. Unlike most scanners, rather than scanning the few ciphers openssl supports, it checks for every possible cipher by enumerating all 65536 cipher codes.

  Tags:  cipher scanner openssl athena-ssl athena ciphers  

• 14:12

  Athena SSL Cipher Scanner 0.6.2

   » ‎ Packet Storm Security Tools
  Athena is a SSL cipher scanner. Unlike most scanners, rather than scanning the few ciphers openssl supports, it checks for every possible cipher by enumerating all 65536 cipher codes.

  Tags:  cipher scanner openssl athena-ssl athena ciphers  

• 14:12

  Athena SSL Cipher Scanner 0.6.2

   » ‎ Packet Storm Security Misc. Files
  Athena is a SSL cipher scanner. Unlike most scanners, rather than scanning the few ciphers openssl supports, it checks for every possible cipher by enumerating all 65536 cipher codes.

  Tags:  cipher scanner openssl athena-ssl athena ciphers  

• December 31, 2010
• 13:45

  HP-UX Running OpenSSL Execution of Arbitrary Code and Denial of Service Vulnerabilities

   » ‎ SecuriTeam
  Potential security vulnerabilities have been identified with HP-UX OpenSSL.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  hp-ux openssl service safer-use denial-of-service  

• December 22, 2010
• 0:00

  Vuln: OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities

  Tags:  dtls openssl packets denial-of-service  

• 0:00

  Vuln: OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

  Tags:  compression openssl zlib service-vulnerability denial-of-service memory-leak  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability

  Tags:  dtls fragment openssl service-vulnerability denial-of-service  

• December 17, 2010
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• December 13, 2010
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• 0:00

  Vuln: OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

  Tags:  modification openssl ciphersuite cipher vulnerability  

• December 10, 2010
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• December 08, 2010
• 10:00

  Bugtraq: [USN-1029-1] OpenSSL vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  [USN-1029-1] OpenSSL vulnerabilities

  Tags:  bugtraq openssl usn  

• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• December 07, 2010
• 0:00

  Vuln: OpenSSL Ciphersuite Downgrade Security Weakness

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Ciphersuite Downgrade Security Weakness

  Tags:  openssl downgrade ciphersuite security-weakness  

• 0:00

  Vuln: OpenSSL J-PAKE Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL J-PAKE Security Bypass Vulnerability

  Tags:  pake openssl vulnerability  

• December 02, 2010
• 0:00

  Vuln: OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

  Tags:  cryptographic openssl message cryptographic-message-syntax memory-corruption vulnerability  

• November 30, 2010
• 20:32

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Advisories
  FreeBSD Security Advisory - A race condition exists in the OpenSSL TLS server extension code parsing when used in a multi-threaded application, which uses OpenSSL's internal caching mechanism. The race condition can lead to a buffer overflow. A double free exists in the SSL client ECDH handling code, when processing specially crafted public keys with invalid prime numbers.

  Tags:  openssl freebsd security freebsd-security buffer-overflow server-extension  

• 20:32

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Recent Files
  FreeBSD Security Advisory - A race condition exists in the OpenSSL TLS server extension code parsing when used in a multi-threaded application, which uses OpenSSL's internal caching mechanism. The race condition can lead to a buffer overflow. A double free exists in the SSL client ECDH handling code, when processing specially crafted public keys with invalid prime numbers.

  Tags:  openssl freebsd security freebsd-security buffer-overflow server-extension  

• 20:32

  FreeBSD Security Advisory - OpenSSL

   » ‎ Packet Storm Security Misc. Files
  FreeBSD Security Advisory - A race condition exists in the OpenSSL TLS server extension code parsing when used in a multi-threaded application, which uses OpenSSL's internal caching mechanism. The race condition can lead to a buffer overflow. A double free exists in the SSL client ECDH handling code, when processing specially crafted public keys with invalid prime numbers.

  Tags:  openssl freebsd security freebsd-security buffer-overflow server-extension  

• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 29, 2010
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• November 23, 2010
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 22, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 19, 2010
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 18, 2010
• 0:00

  Vuln: OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL TLS Server Extension Parsing Buffer Overflow Vulnerability

  Tags:  server tls openssl buffer-overflow-vulnerability tls-server server-extension  

• November 17, 2010
• 17:44

  OpenSSL Bug Could Squash Your System

   » ‎ Packet Storm Security Headlines
  OpenSSL Bug Could Squash Your System

  Tags:  bug openssl squash  

• 16:32

  OpenSSL Toolkit 1.0.0b

   » ‎ Packet Storm Security Recent Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 16:32

  OpenSSL Toolkit 1.0.0b

   » ‎ Packet Storm Security Misc. Files
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  openssl toolkit layer openssl-toolkit transport-layer-security secure-sockets-layer  

• 16:30

  OpenSSL Security Advisory - TLS Extension Race Condition

   » ‎ Packet Storm Security Advisories
  A flaw has been found in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. All versions of OpenSSL supporting TLS extensions contain this vulnerability including OpenSSL 0.9.8f through 0.9.8o, 1.0.0, 1.0.0a releases. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected. In particular the Apache HTTP server (which never uses OpenSSL internal caching) and Stunnel (which includes its own workaround) are NOT affected.

  Tags:  server tls openssl tls-extension apache-http-server buffer-overrun  

• 16:30

  OpenSSL Security Advisory - TLS Extension Race Condition

   » ‎ Packet Storm Security Recent Files
  A flaw has been found in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. All versions of OpenSSL supporting TLS extensions contain this vulnerability including OpenSSL 0.9.8f through 0.9.8o, 1.0.0, 1.0.0a releases. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected. In particular the Apache HTTP server (which never uses OpenSSL internal caching) and Stunnel (which includes its own workaround) are NOT affected.

  Tags:  server tls openssl tls-extension apache-http-server buffer-overrun  

• 16:30

  OpenSSL Security Advisory - TLS Extension Race Condition

   » ‎ Packet Storm Security Misc. Files
  A flaw has been found in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. All versions of OpenSSL supporting TLS extensions contain this vulnerability including OpenSSL 0.9.8f through 0.9.8o, 1.0.0, 1.0.0a releases. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected. In particular the Apache HTTP server (which never uses OpenSSL internal caching) and Stunnel (which includes its own workaround) are NOT affected.

  Tags:  server tls openssl tls-extension apache-http-server buffer-overrun  

• November 03, 2010
• 0:00

  Vuln: OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

  Tags:  evp openssl verifyfinal signature-verification vulnerability  

• October 07, 2010
• 10:00

  Bugtraq: [USN-1003-1] OpenSSL vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  [USN-1003-1] OpenSSL vulnerabilities

  Tags:  bugtraq openssl usn  

• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• September 30, 2010
• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• September 21, 2010
• 10:00

  Bugtraq: [USN-990-1] OpenSSL vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [USN-990-1] OpenSSL vulnerability

  Tags:  bugtraq vulnerability openssl usn  

• September 03, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• September 01, 2010
• 14:02

  MDVSA-2010-168.txt

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2010-168 - Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service and possibly execute some sources refer to this as a use-after-free issue. The updated packages have been patched to correct this issue.

  Tags:  mdvsa openssl issue exchange-function denial-of-service ssl3  

• 14:00

  MDVSA-2010-168.txt

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2010-168 - Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service and possibly execute some sources refer to this as a use-after-free issue. The updated packages have been patched to correct this issue.

  Tags:  mdvsa openssl issue exchange-function denial-of-service ssl3  

• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• August 10, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption Vulnerability

  Tags:  exchange ssl openssl memory-corruption free-memory key-exchange  

• July 28, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• July 08, 2010
• 0:00

  Vuln: OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

  Tags:  cryptographic openssl message cryptographic-message-syntax memory-corruption vulnerability  

• June 24, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• June 23, 2010
• 21:04

  [Video] Predictable RNG in the Vulnerable Debian OpenSSL package, the What and the How

   » ‎ SecDocs
  Authors: Luciano Bello Maximiliano Bertacchini
  Tags: vulnerability openSSL
  Event: Black Hat USA 2008
  

  Tags:  predictable video openssl luciano-bello-maximiliano-bertacchini usa maximiliano black-hat rng  

• 21:04

  [Audio] Predictable RNG in the Vulnerable Debian OpenSSL package, the What and the How

   » ‎ SecDocs
  Authors: Luciano Bello Maximiliano Bertacchini
  Tags: vulnerability openSSL
  Event: Black Hat USA 2008
  

  Tags:  predictable audio openssl luciano-bello-maximiliano-bertacchini usa maximiliano black-hat rng  

• June 22, 2010
• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability

  Tags:  dtls fragment openssl service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

  Tags:  compression openssl zlib service-vulnerability denial-of-service memory-leak  

• June 17, 2010
• 22:01

  HP-UX OpenSSL Unauthorized Information Disclosure and Denial of Service Vulnerabilities

   » ‎ SecuriTeam
  Potential security vulnerabilities have been identified with HP-UX OpenSSL.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  hp-ux openssl service information-disclosure safer-use denial-of-service  

• 0:00

  Vuln: OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

  Tags:  cryptographic openssl message cryptographic-message-syntax memory-corruption vulnerability  

• 0:00

  Vuln: OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

  Tags:  evp pkey openssl value-security vulnerability  

• 0:00

  Vuln: OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_VerifyFinal' Function Signature Verification Vulnerability

  Tags:  evp openssl verifyfinal signature-verification vulnerability  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• June 16, 2010
• 0:00

  Vuln: OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

  Tags:  evp pkey openssl value-security vulnerability  

• June 03, 2010
• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• June 02, 2010
• 22:01

  openssl-1.0.0a.tar.gz

   » ‎ Packet Storm Security Tools
  OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

  Tags:  tar layer openssl transport-layer-security secure-sockets-layer tar-gz  

• 0:00

  Vuln: OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL Cryptographic Message Syntax Memory Corruption Vulnerability

  Tags:  cryptographic openssl message cryptographic-message-syntax memory-corruption vulnerability  

• 0:00

  Vuln: OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'EVP_PKEY_verify_recover()' Invalid Return Value Security Bypass Vulnerability

  Tags:  evp pkey openssl value-security vulnerability  

• May 28, 2010
• 15:00

  VMSA-2010-0009.txt

   » ‎ Packet Storm Security Advisories
  VMware Security Advisory - ESXi update for ntp and ESX Console OS (COS) updates for COS kernel, openssl, krb5, gcc, bind, gzip, sudo.

  Tags:  txt vmsa cos os-cos ntp openssl  

• 0:00

  Vuln: OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

  Tags:  compression openssl zlib service-vulnerability denial-of-service memory-leak  

• May 25, 2010
• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  openssl vulnerability  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'zlib' Compression Memory Leak Remote Denial of Service Vulnerability

  Tags:  compression openssl zlib service-vulnerability denial-of-service memory-leak  

• May 24, 2010
• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• May 11, 2010
• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• May 10, 2010
• 11:00

  Bugtraq: rPSA-2010-0036-1 openssl openssl-scripts

   » ‎ SecurityFocus Vulnerabilities
  rPSA-2010-0036-1 openssl openssl-scripts

  Tags:  bugtraq rpsa openssl scripts  

• May 07, 2010
• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• April 22, 2010
• 23:00

  hoagie_openssl_record_of_death.c

   » ‎ Packet Storm Security Exploits
  OpenSSL versions 0.9.8f through 0.9.8m remote denial of service exploit.

  Tags:  hoagie record openssl denial-of-service  

• 1:00

  OpenSSL remote Denial of Service

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  OpenSSL remote Denial of Service

  Tags:  openssl denial service denial-of-service  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ChangeCipherSpec' DTLS Packet Denial of Service Vulnerability

  Tags:  dtls openssl changecipherspec service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL DTLS Packets Multiple Denial of Service Vulnerabilities

  Tags:  dtls openssl packets denial-of-service  

• April 20, 2010
• 14:00

  Bugtraq: [ MDVSA-2010:076-1 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2010:076-1 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 9:00

  MDVSA-2010-076-1.txt

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2010-076 - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls which has unspecified impact and context-dependent attack vectors. The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, could allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash). Finally, this update provides support for secure renegotiation, preventing men-in-the-middle attacks. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products. Packages for 2009.0 are provided due to the Extended Maintenance Program.

  Tags:  function openssl ssl null-pointer-dereference mandriva-linux kssl  

• 9:00

  MDVSA-2010-076-1.txt

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2010-076 - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls which has unspecified impact and context-dependent attack vectors. The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, could allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash). Finally, this update provides support for secure renegotiation, preventing men-in-the-middle attacks. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products. Packages for 2009.0 are provided due to the Extended Maintenance Program.

  Tags:  function openssl ssl null-pointer-dereference mandriva-linux kssl  

• April 19, 2010
• 14:00

  MDVSA-2010-076.txt

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2010-076 - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls which has unspecified impact and context-dependent attack vectors. The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, could allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash). Finally, this update provides support for secure renegotiation, preventing men-in-the-middle attacks. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

  Tags:  function openssl ssl null-pointer-dereference mandriva-linux kssl  

• 14:00

  MDVSA-2010-076.txt

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2010-076 - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls which has unspecified impact and context-dependent attack vectors. The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, could allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash). Finally, this update provides support for secure renegotiation, preventing men-in-the-middle attacks. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

  Tags:  function openssl ssl null-pointer-dereference mandriva-linux kssl  

• 10:00

  Bugtraq: [ MDVSA-2010:076 ] openssl

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2010:076 ] openssl

  Tags:  bugtraq mdvsa openssl  

• 0:00

  Vuln: OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'dtls1_retrieve_buffered_fragment()' Remote Denial of Service Vulnerability

  Tags:  fragment openssl remote service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'ssl3_get_record()' Remote Denial of Service Vulnerability

  Tags:  ssl openssl record service-vulnerability denial-of-service  

• 0:00

  Vuln: OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  OpenSSL 'bn_wexpend()' Error Handling Unspecified Vulnerability

  Tags:  error openssl wexpend vulnerability