CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-0537
https://notcve.org/view.php?id=CVE-2015-0537
Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service (memory corruption or segmentation fault) or possibly have unspecified other impact via crafted base64 data, a similar issue to CVE-2015-0292. Vulnerabilidad de desbordamiento inferior de entero en la implementación base64-decoding en EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x en versiones anteriores a 4.0.8 y 4.1.x en versiones anteriores a 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) en versiones anteriores a 4.0.4 y 4.1 y RSA BSAFE SSL-C 2.8.9 y anteriores, permite a atacantes remotos causar una denegación de servicio (corrupción de memoria o fallo de segmentación) o posiblemente tener otro impacto no especificado a través de datos base64 manipulados, un problema similar a CVE-2015-0292. • http://seclists.org/bugtraq/2015/Aug/84 http://www.securityfocus.com/bid/76377 http://www.securitytracker.com/id/1033299 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2007-6755
https://notcve.org/view.php?id=CVE-2007-6755
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE. El procedimiento por defecto del NIST SP 800-90A del algoritmo Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) contiene puntos constantes Q con una posible relación con ciertos valores "skeleton key", lo que podría permitir a atacantes dependientes del contexto romper mecanismos criptográficos de protección mediante el aprovechando del conocimiento de esos valores. NOTA: este es un CVE preliminar para Dual_EC_DRBG, la investigación futura puede brindar detalles adicionales sobre el punto Q y los ataques asociados, y podría potencialmente dar lugar a un RECAST o REJECT de esta CVE. • http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html http://rump2007.cr.yp.to/15-shumow.pdf http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655 http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect http://www.securityfocus.com/bid • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 5.0EPSS: 10%CPEs: 2EXPL: 0CVE-2006-3894
https://notcve.org/view.php?id=CVE-2006-3894
The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows remote attackers to cause a denial of service via malformed ASN.1 objects. Las librerías RSA Crypto-C anterior a 6.3.1 y Cert-C anterior a 2.8, usadas por RSA BSAFE, múltiples productos Cisco, y otros productos, permite a atacantes remotos provocar una denegación de servicio mediante objetos ASN.1 mal formados. • http://jvn.jp/cert/JVNVU%23754281/index.html http://osvdb.org/35338 http://secunia.com/advisories/25343 http://secunia.com/advisories/25364 http://secunia.com/advisories/25399 http://www.cisco.com/en/US/products/products_security_advisory09186a0080847c5d.shtml http://www.kb.cert.org/vuls/id/754281 http://www.securityfocus.com/bid/24104 http://www.securitytracker.com/id?1018095 http://www.vupen.com/english/advisories/2007/1908 http://www.vupen.com/english/advisories/2007& •