CVSS: 7.5EPSS: 7%CPEs: 67EXPL: 0CVE-2012-0027
https://notcve.org/view.php?id=CVE-2012-0027
06 Jan 2012 — The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client. El motor GOST en OpenSSL antes de v1.0.0f no controla correctamente los parámetros válidos para el cifrado de bloques GOST, lo que permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de datos de un cliente TLS específicamente modificados. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 20%CPEs: 64EXPL: 0CVE-2011-4619 – openssl: SGC restart DoS attack
https://notcve.org/view.php?id=CVE-2011-4619
06 Jan 2012 — The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. La implementación del servidor de criptografía SGC en OpenSSL antes de v0.9.8s y en v1.x antes de v1.0.0f no controla correctamente los reinicios de 'handshake' (apretón de manos), lo que permite a atacantes remotos provocar una denegación de servicio a través de vec... • http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 1%CPEs: 64EXPL: 0CVE-2011-4576 – openssl: uninitialized SSL 3.0 padding
https://notcve.org/view.php?id=CVE-2011-4576
06 Jan 2012 — The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. La implementación SSL v3.0 en OpenSSL antes de v0.9.8s y v1.x antes de v1.0.0f no inicializa correctamente las estructuras de datos para el relleno de bloques de cifrado, lo que podría permitir a atacantes remotos obtener información sensible desci... • http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc • CWE-310: Cryptographic Issues •
CVSS: 5.9EPSS: 0%CPEs: 78EXPL: 1CVE-2011-1945 – Gentoo Linux Security Advisory 201312-03
https://notcve.org/view.php?id=CVE-2011-1945
31 May 2011 — The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation. El subsistema de criptografía de curva elíptica (ECC) de OpenSSL v1.0.0d y versiones anteriores, cuando el algoritmo de firma digital de la curva elí... • http://eprint.iacr.org/2011/232.pdf • CWE-310: Cryptographic Issues •
CVSS: 9.1EPSS: 0%CPEs: 61EXPL: 0CVE-2008-7270 – openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG downgrade-to-disabled ciphersuite attack
https://notcve.org/view.php?id=CVE-2008-7270
06 Dec 2010 — OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180. OpenSSL en versiones anteriores a la 0.9.8j, si SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG está activado, no previene la modificación de sus datos en la caché de sesión,... • http://cvs.openssl.org/chngview?cn=17489 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 13%CPEs: 22EXPL: 0CVE-2010-4180 – openssl: NETSCAPE_REUSE_CIPHER_CHANGE_BUG ciphersuite downgrade attack
https://notcve.org/view.php?id=CVE-2010-4180
06 Dec 2010 — OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. OpenSSL en versiones anteriores a 0.9.8q y 1.0.x en versiones anteriores a 1.0.0c, cuando SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG está habilitado, no previene adecuadame... • http://cvs.openssl.org/chngview?cn=20131 •
CVSS: 9.8EPSS: 4%CPEs: 76EXPL: 1CVE-2010-4252
https://notcve.org/view.php?id=CVE-2010-4252
06 Dec 2010 — OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol. OpenSSL en versiones anteriores a la 1.0.0c, si J-PAKE está activado, no valida apropiadamente los parámetros públicos en el protocolo J-PAKE, lo que permite a atacantes remotos evitar la necesidad de saber el secreto c... • http://cvs.openssl.org/chngview?cn=20098 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 18%CPEs: 72EXPL: 0CVE-2010-0742
https://notcve.org/view.php?id=CVE-2010-0742
03 Jun 2010 — The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors. Vulnerabilidad en la implemtanción "Cryptographic Message Syntax" (CMS) en "crypto/cms/cms_asn1.c" en OpenSSL anterior a v0.9.8o y v1.x anterior a v1.0... • http://cvs.openssl.org/chngview?cn=19693 • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 1%CPEs: 13EXPL: 0CVE-2009-3245 – openssl: missing bn_wexpand return value checks
https://notcve.org/view.php?id=CVE-2009-3245
05 Mar 2010 — OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors. OpenSSL en versiones anterioes a v0.9.8m cuando recibe un valor de retorno NULL de la funcion bn_wexpand hace una llamada a (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, y (4) engines/e_ubsec.c, lo que tiene un impacto ... • http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 8%CPEs: 14EXPL: 0CVE-2010-0433 – openssl: crash caused by a missing krb5_sname_to_principal() return value check
https://notcve.org/view.php?id=CVE-2010-0433
05 Mar 2010 — The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot. La funcion kssl_keytab_is_available en ssl/kssl.c en OpenSSL before v... • http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc • CWE-20: Improper Input Validation •