Most recent entries from all

bdu:2015-09820

Withdrawn: BELL-CVE-2015-0209 — CVE-2015-0209 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2015-avi-089 — De multiples vulnérabilités ont été corrigées dans OpenSSL. Elles permettent à un attaquant…

certfr-2015-avi-089

cnvd-2015-01898

EUVD-2026-89152

fkie_cve-2015-0209

Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

GHSA-gc3c-j46x-fm67

gsd-2015-0209

ICSA-22-349-21 — Siemens SCALANCE X-200RNA Switch Devices

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190. The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server. The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote…

openSUSE-SU-2024:10271-1 — libopenssl-devel-1.0.2j-2.2 on GA media

libopenssl-devel-1.0.2j-2.2 on GA media

RHSA-2015:0715 — Red Hat Security Advisory: openssl security update

openssl: use-after-free on invalid EC private key import openssl: invalid pointer use in ASN1_TYPE_cmp() openssl: ASN.1 structure reuse memory corruption openssl: X509_to_X509_REQ NULL pointer dereference openssl: PKCS7 NULL pointer dereference openssl: integer underflow leading to buffer overflow in base64 decoding openssl: assertion failure in SSLv2 servers openssl: Divide-and-conquer session key recovery in SSLv2 openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers

SUSE-RU-2015:0769-1 — Security update for openssl1

Security update for openssl1

UBUNTU-CVE-2015-0209

Affected: Ubuntu:14.04:LTS: openssl

WID-SEC-W-2026-0180 — Dell Data Protection Advisor: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.