Branch c7 update bulletin.

Package openssl10 updated to version 1.0.1j-alt1.M70C.1 for branch c7 in task 133754.

Published: 2014-06-05

BDU:2015-00125

Уязвимость программного обеспечения Cisco ACE, позволяющая злоумышленнику перехватить сессию

Severity: MEDIUM (4.3)

References:

Published: 1970-01-01

BDU:2015-00126

Уязвимость программного обеспечения Cisco ASA, позволяющая злоумышленнику перехватить сессию

Severity: MEDIUM (4.3)

References:

Published: 1970-01-01

BDU:2015-00127

Уязвимость программного обеспечения Cisco IPS, позволяющая злоумышленнику перехватить сессию

Severity: MEDIUM (4.3)

References:

Published: 1970-01-01

BDU:2015-00128

Уязвимость программного обеспечения Cisco Unified Communications Manager, позволяющая злоумышленнику перехватить сессию

Severity: MEDIUM (4.3)

References:

Published: 2014-10-15

BDU:2015-00640

Уязвимость программного обеспечения OpenSSL, позволяющая удаленному злоумышленнику нарушить доступность защищаемой информации

Severity: MEDIUM (5.0)

References:

Published: 2014-10-15

BDU:2015-00641

Уязвимость программного обеспечения OpenSSL, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации

Severity: LOW (2.6)

References:

Published: 2014-10-15

BDU:2015-00642

Severity: MEDIUM (4.3)

References:

Published: 2014-08-06

BDU:2015-00644

Severity: MEDIUM (5.0)

References:

Published: 2014-08-06

BDU:2015-00645

Уязвимость программного обеспечения OpenSSL, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: HIGH (7.5)

References:

Published: 2014-08-06

BDU:2015-00646

Severity: MEDIUM (5.0)

References:

Published: 2014-08-06

BDU:2015-00647

Severity: MEDIUM (5.0)

References:

Published: 2014-08-06

BDU:2015-00648

Severity: MEDIUM (4.3)

References:

Published: 2014-08-06

BDU:2015-00649

Severity: MEDIUM (4.3)

References:

Published: 2014-08-06

BDU:2015-00650

Severity: MEDIUM (6.8)

References:

Published: 2014-08-06

BDU:2015-00651

Severity: MEDIUM (4.3)

References:

Published: 2014-08-06

BDU:2015-00652

Уязвимость программного обеспечения OpenSSL, позволяющая удаленному злоумышленнику нарушить защищаемой информации

Severity: MEDIUM (4.3)

References:

Published: 2014-10-15

BDU:2015-00653

Уязвимость программного обеспечения OpenSSL, позволяющая удаленному злоумышленнику нарушить конфиденциальность и доступность защищаемой информации

Severity: HIGH (7.8)

References:

Published: 1970-01-01

BDU:2015-04312

Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-04313

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05844

Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05845

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05846

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05847

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05848

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05849

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05850

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05851

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05852

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05853

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05854

Severity: MEDIUM (6.8)

References:

Published: 1970-01-01

BDU:2015-05855

Severity: MEDIUM (6.8)

References:

Published: 2014-06-05

BDU:2015-07477

Уязвимость операционной системы Red Hat Enterprise Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (10.0)

References:

Published: 2014-06-05

BDU:2015-07482

Severity: HIGH (7.5)

References:

Published: 2014-06-05

BDU:2015-07483

Severity: MEDIUM (6.8)

References:

Published: 2014-06-05

BDU:2015-07485

Severity: CRITICAL (10.0)

References:

Published: 2014-07-27

BDU:2015-09698

Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: MEDIUM (6.8)

References:

Published: 2014-12-26

BDU:2015-09775

Severity: HIGH (7.5)

References:

Published: 2014-04-15
Modified: 2022-08-29

CVE-2010-5298

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Severity: MEDIUM (4.0)

References:

Published: 2014-06-06
Modified: 2024-11-21

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

Severity: HIGH (7.4) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3505

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.

Severity: MEDIUM (5.0)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3506

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.

Severity: MEDIUM (5.0)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3507

Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.

Severity: MEDIUM (5.0)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3508

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.

Severity: MEDIUM (4.3)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3509

Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.

Severity: MEDIUM (6.8)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3510

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.

Severity: MEDIUM (4.3)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3511

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.

Severity: MEDIUM (4.3)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-3512

Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.

Severity: HIGH (7.5)

References:

Published: 2014-10-19
Modified: 2024-11-21

CVE-2014-3513

Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

Severity: HIGH (7.1)

References:

Published: 2014-10-15
Modified: 2024-11-27

CVE-2014-3566

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.

Severity: LOW (3.4) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

References:

Published: 2014-10-19
Modified: 2024-11-21

CVE-2014-3567

Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

Severity: HIGH (7.1)

References:

Published: 2014-10-19
Modified: 2024-11-21

CVE-2014-3568

OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

Severity: MEDIUM (4.3)

References:

Published: 2014-08-14
Modified: 2024-11-21

CVE-2014-5139

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

Severity: MEDIUM (4.3)

References:

Version: 2.1.0

ALT-BU-2014-3087-1

Closed vulnerabilities