CVE search results

51 – 60 of 135 results

Detailed view

Sort by:

CVE-2016-0704

Medium priority

Not affected

An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect...

2 affected packages

openssl098, openssl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl098	—	—	—	—
openssl	—	—	—	—

CVE-2016-0703

High priority

Not affected

The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

CVE-2016-0702

Low priority

Some fixes available 10 of 11

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	Fixed
openssl098	—	—	—	Not in release

CVE-2016-0701

Medium priority

Fixed

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

CVE-2015-7575

Medium priority

Some fixes available 38 of 44

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol...

12 affected packages

firefox, gnutls26, gnutls28, mbedtls, nss...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
firefox	—	—	—	Fixed
gnutls26	—	—	—	Not in release
gnutls28	—	—	—	Not affected
mbedtls	—	—	—	Not affected
nss	—	—	—	Not affected
openjdk-6	—	—	—	Not in release
openjdk-7	—	—	—	Not in release
openjdk-8	—	—	—	Not affected
openssl	—	—	—	Not affected
openssl098	—	—	—	Not in release
polarssl	—	—	—	Not in release
thunderbird	—	—	—	Fixed

CVE-2015-5738

Medium priority

Not affected

The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

CVE-2015-4000

Medium priority

Some fixes available 48 of 55

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks...

11 affected packages

apache2, firefox, gnutls26, gnutls28, nss...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	—	—	—	Not affected
firefox	—	—	—	Fixed
gnutls26	—	—	—	Not in release
gnutls28	—	—	—	Not affected
nss	—	—	—	Fixed
openjdk-6	—	—	—	Not in release
openjdk-7	—	—	—	Not in release
openjdk-8	—	—	—	Not affected
openssl	—	—	—	Not affected
openssl098	—	—	—	Not in release
thunderbird	—	—	—	Fixed

CVE-2015-3216

Medium priority

Not affected

Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, allows remote...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

CVE-2015-3197

Medium priority

Not affected

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

CVE-2015-3196

Low priority

Fixed

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a...

2 affected packages

openssl, openssl098

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
openssl	—	—	—	—
openssl098	—	—	—	—

Export to JSON

Results by page:

Search CVE reports