Most recent entries from all

bdu:2016-00629

Withdrawn: BELL-CVE-2016-0703 — CVE-2016-0703 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2016-avi-076 — De multiples vulnérabilités ont été corrigées dans OpenSSL. Elles permettent à un attaquant…

certfr-2016-avi-076

cnvd-2016-01435

EUVD-2026-81497

fkie_cve-2016-0703

The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

GHSA-jqfv-c9gp-wf8f

gsd-2016-0703

ICSA-22-349-21 — Siemens SCALANCE X-200RNA Switch Devices

OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine valid usernames via a timing attack. sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190. The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data. The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server. The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote…

RHSA-2015:0715 — Red Hat Security Advisory: openssl security update

openssl: use-after-free on invalid EC private key import openssl: invalid pointer use in ASN1_TYPE_cmp() openssl: ASN.1 structure reuse memory corruption openssl: X509_to_X509_REQ NULL pointer dereference openssl: PKCS7 NULL pointer dereference openssl: integer underflow leading to buffer overflow in base64 decoding openssl: assertion failure in SSLv2 servers openssl: Divide-and-conquer session key recovery in SSLv2 openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers

RHSA-2015:0716 — Red Hat Security Advisory: openssl security and bug fix update

SUSE-SU-2016:0617-1 — Security update for openssl

Security update for openssl

WID-SEC-W-2023-0427 — OpenSSL: Mehrere Schwachstellen

Ein anonymer, lokaler bzw. entfernter Angreifer kann mehrere Schwachstellen in OpenSSL, Ubuntu Linux, Debian Linux Wheezy (7.0), Debian Linux Jessie (8.0), Red Hat Enterprise Linux HPC Node, Red Hat Enterprise Linux Server EUS, Red Hat Enterprise Linux Workstation, Red Hat Enterprise Linux Server, Red Hat Enterprise Linux Desktop, Red Hat Enterprise Linux Server AUS, Arista EOS und Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, beliebigen Programcode mit den Rechten des Dienstes auszuführen oder um einen Denial of Service Zustand herbeizuführen.