ID

VAR-201505-0233


CVE

CVE-2015-4000


TITLE

OpenSSL CVE-2015-1793 Certificate Verification Security Bypass Vulnerability

Trust: 0.3

sources: BID: 75652

DESCRIPTION

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. OpenSSL is prone to a security-bypass vulnerability because the application fails to properly verify SSL, TLS, and DTLS certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks and bypass certain security restrictions. This may aid in further attacks. OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n, and 1.0.1o are vulnerable. OpenSSL Security Advisory [11 Jun 2015] ======================================= DHE man-in-the-middle protection (Logjam) ==================================================================== A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam (CVE-2015-4000). OpenSSL has added protection for TLS clients by rejecting handshakes with DH parameters shorter than 768 bits. This limit will be increased to 1024 bits in a future release. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n Fixes for this issue were developed by Emilia Käsper and Kurt Roeckx of the OpenSSL development team. Malformed ECParameters causes infinite loop (CVE-2015-1788) =========================================================== Severity: Moderate When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled. 1.0.0d and 0.9.8r and below are affected. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n OpenSSL 1.0.0d (and below) users should upgrade to 1.0.0s OpenSSL 0.9.8r (and below) users should upgrade to 0.9.8zg This issue was reported to OpenSSL on 6th April 2015 by Joseph Birr-Pixton. The fix was developed by Andy Polyakov of the OpenSSL development team. Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789) =============================================================== Severity: Moderate X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n OpenSSL 1.0.0 users should upgrade to 1.0.0s OpenSSL 0.9.8 users should upgrade to 0.9.8zg This issue was reported to OpenSSL on 8th April 2015 by Robert Swiecki (Google), and independently on 11th April 2015 by Hanno Böck. The fix was developed by Emilia Käsper of the OpenSSL development team. PKCS7 crash with missing EnvelopedContent (CVE-2015-1790) ========================================================= Severity: Moderate The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n OpenSSL 1.0.0 users should upgrade to 1.0.0s OpenSSL 0.9.8 users should upgrade to 0.9.8zg This issue was reported to OpenSSL on 18th April 2015 by Michal Zalewski (Google). The fix was developed by Emilia Käsper of the OpenSSL development team. CMS verify infinite loop with unknown hash function (CVE-2015-1792) =================================================================== Severity: Moderate When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n OpenSSL 1.0.0 users should upgrade to 1.0.0s OpenSSL 0.9.8 users should upgrade to 0.9.8zg This issue was reported to OpenSSL on 31st March 2015 by Johannes Bauer. The fix was developed by Dr. Stephen Henson of the OpenSSL development team. Race condition handling NewSessionTicket (CVE-2015-1791) ======================================================== Severity: Low If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. OpenSSL 1.0.2 users should upgrade to 1.0.2b OpenSSL 1.0.1 users should upgrade to 1.0.1n OpenSSL 1.0.0 users should upgrade to 1.0.0s OpenSSL 0.9.8 users should upgrade to 0.9.8zg This issue was discovered by Emilia Käsper of the OpenSSL development team. The fix was developed by Matt Caswell of the OpenSSL development team. Invalid free in DTLS (CVE-2014-8176) ==================================== Severity: Moderate This vulnerability does not affect current versions of OpenSSL. It existed in previous OpenSSL versions and was fixed in June 2014. If a DTLS peer receives application data between the ChangeCipherSpec and Finished messages, buffering of such data may cause an invalid free, resulting in a segmentation fault or potentially, memory corruption. This issue was originally reported on March 28th 2014 in https://rt.openssl.org/Ticket/Display.html?id=3286 by Praveen Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert (Google). A fix was developed by zhu qun-ying. The fix for this issue can be identified by commits bcc31166 (1.0.1), b79e6e3a (1.0.0) and 4b258e73 (0.9.8). Note ==== As per our previous announcements and our Release Strategy (https://www.openssl.org/about/releasestrat.html), support for OpenSSL versions 1.0.0 and 0.9.8 will cease on 31st December 2015. No security updates for these releases will be provided after that date. Users of these releases are advised to upgrade. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv_20150611.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/about/secpolicy.html . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.5.0-ibm security update Advisory ID: RHSA-2015:1544-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1544.html Issue date: 2015-08-04 CVE Names: CVE-2015-1931 CVE-2015-2590 CVE-2015-2601 CVE-2015-2621 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-4000 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 ===================================================================== 1. Summary: Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, ppc, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 3. Description: IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-1931, CVE-2015-2590, CVE-2015-2601, CVE-2015-2621, CVE-2015-2632, CVE-2015-2637, CVE-2015-2638, CVE-2015-2664, CVE-2015-4000, CVE-2015-4731, CVE-2015-4732, CVE-2015-4733, CVE-2015-4748, CVE-2015-4749, CVE-2015-4760) Note: This update forces the TLS/SSL client implementation in IBM JDK to reject DH key sizes below 768 bits to address the CVE-2015-4000 issue. Refer to Red Hat Bugzilla bug 1223211, linked to in the References section, for additional details about this change. IBM Java SDK and JRE 5.0 will not receive software updates after September 2015. This date is referred to as the End of Service (EOS) date. Customers are advised to migrate to current versions of IBM Java at this time. IBM Java SDK and JRE versions 6 and 7 are available via the Red Hat Enterprise Linux 5 and 6 Supplementary content sets and will continue to receive updates based on IBM's lifecycle policy, linked to in the References section. Customers can also consider OpenJDK, an open source implementation of the Java SE specification. OpenJDK is available by default on supported hardware architectures. All running instances of IBM Java must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1223211 - CVE-2015-4000 LOGJAM: TLS connections which support export grade DHE key-exchange are vulnerable to MITM attacks 1242019 - CVE-2015-2601 OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865) 1242234 - CVE-2015-4731 OpenJDK: improper permission checks in MBeanServerInvocationHandler (JMX, 8076397) 1242240 - CVE-2015-4732 OpenJDK: insufficient context checks during object deserialization (Libraries, 8076405) 1242275 - CVE-2015-4733 OpenJDK: RemoteObjectInvocationHandler allows calling finalize() (RMI, 8076409) 1242281 - CVE-2015-4748 OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374) 1242372 - CVE-2015-2621 OpenJDK: incorrect code permission checks in RMIConnectionImpl (JMX, 8075853) 1242379 - CVE-2015-4749 OpenJDK: DnsClient fails to release request information after error (JNDI, 8075378) 1242394 - CVE-2015-2632 ICU: integer overflow in LETableReference verifyLength() (OpenJDK 2D, 8077520) 1242447 - CVE-2015-4760 ICU: missing boundary checks in layout engine (OpenJDK 2D, 8071715) 1243139 - CVE-2015-2590 OpenJDK: deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401) 1243283 - CVE-2015-2638 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) 1243287 - CVE-2015-2637 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (2D) 1243300 - CVE-2015-2664 Oracle JDK: unspecified vulnerability fixed in 6u101, 7u85 and 8u51 (Deployment) 1244828 - CVE-2015-1931 IBM JDK: plain text data stored in memory dumps 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 5): i386: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.i386.rpm ppc: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.ppc64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.ppc.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.s390.rpm java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.s390x.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.s390x.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.s390.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.s390x.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.s390.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.s390.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.s390.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el5.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el5.x86_64.rpm Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.i686.rpm ppc64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.ppc64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.ppc64.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.s390x.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.s390x.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.s390x.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-jdbc-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-plugin-1.5.0.16.13-1jpp.3.el6_7.i686.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.i686.rpm x86_64: java-1.5.0-ibm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm java-1.5.0-ibm-src-1.5.0.16.13-1jpp.3.el6_7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-1931 https://access.redhat.com/security/cve/CVE-2015-2590 https://access.redhat.com/security/cve/CVE-2015-2601 https://access.redhat.com/security/cve/CVE-2015-2621 https://access.redhat.com/security/cve/CVE-2015-2632 https://access.redhat.com/security/cve/CVE-2015-2637 https://access.redhat.com/security/cve/CVE-2015-2638 https://access.redhat.com/security/cve/CVE-2015-2664 https://access.redhat.com/security/cve/CVE-2015-4000 https://access.redhat.com/security/cve/CVE-2015-4731 https://access.redhat.com/security/cve/CVE-2015-4732 https://access.redhat.com/security/cve/CVE-2015-4733 https://access.redhat.com/security/cve/CVE-2015-4748 https://access.redhat.com/security/cve/CVE-2015-4749 https://access.redhat.com/security/cve/CVE-2015-4760 https://access.redhat.com/security/updates/classification/#important https://www.ibm.com/developerworks/java/jdk/alerts/ https://www.ibm.com/developerworks/java/jdk/lifecycle/ https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c33 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVwPPkXlSAg2UNWIIRAo58AJ0f5ydeQDOPD94MBu+9dLB4StLPgACgv9P0 jLcHugyRDfZPLmcsHXcjvoY= =lSeA -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-2656-1 July 09, 2015 firefox vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.10 - Ubuntu 14.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. (CVE-2015-2721) Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2722, CVE-2015-2733) Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726) Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. (CVE-2015-2727) Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2728) Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-2729) Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730) A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2731) Ronald Crane discovered multiple security vulnerabilities. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740) David Keeler discovered that key pinning checks can be skipped when an overridable certificate error occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited on its own. (CVE-2015-2741) Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another security vulnerability, to execute arbitrary code in a privileged scope. An attacker could potentially exploit this to impersonate the server. (CVE-2015-4000) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: firefox 39.0+build5-0ubuntu0.15.04.1 Ubuntu 14.10: firefox 39.0+build5-0ubuntu0.14.10.1 Ubuntu 14.04 LTS: firefox 39.0+build5-0ubuntu0.14.04.1 After a standard system update you need to restart Firefox to make all the necessary changes. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. + 3PAR OS 3.2.1 MU5 and 3.2.2 MU2 - HPE recommends prior impacted versions update to 3PAR OS 3.2.1 MU 5 or 3.2.2 MU2. + 3PAR OS 3.1.3 is also vulnerable but will not be fixed. **Mitigation:** The best protection to guard against exploitation of this vulnerability is to securely configure and operate the storage array in accordance with the *HPE 3PAR Configuration Guidelines* documentation. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c04926789 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04926789 Version: 1 HPSBUX03435 SSRT102977 rev.1 - HP-UX Web Server Suite running Apache, Remote Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2016-01-07 Last Updated: 2016-01-07 Potential Security Impact: Remote Denial of Service (DoS) Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Web Server Suite running Apache on HP-UX 11iv3. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS) and other impacts including: The TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as "Logjam" could be exploited remotely to allow unauthorized modification. The RC4 stream cipher vulnerability in SSL/TLS known as "Bar Mitzvah" could be exploited remotely to allow disclosure of information. Apache does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters. HP-UX Web Server Suite v4.05 HPUXWSATW405 httpd prior to 2.2.29.02 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-4000 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2015-2808 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2015-3183 (AV:N/AC:L/Au:N/C:N/I:P/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities with HP-UX Web Server Suite running Apache. The updates are available for download from the following location: https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumbe r=HPUXWSATW406 Issues addressed: CVE-2015-4000: Disable Export cipher by default. DH parameter with 1024 bits is used by default. Allow to configure custom DHE or ECDHE parameters by appending the concerned parameter file to the certificate file given for the SSLCertificateFile directive. CVE-2015-2808: Disable RC4 cipher in configuration file. Notes: HP-UX Web Server Suite v4.06 HPUXWSATW406 contains the following components: Apache B.2.2.29.02 Tomcat Servlet Engine C.6.0.43.01 PHP 5.4.40.1 (Part of Apache) Webmin A.1.070.13 See HPE Security Bulletin HPSBUX03512 for information about resolution for Apache web server of HP-UX 11iv2 at the following location: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04832246 MANUAL ACTIONS: Yes - Update Download and install the software update PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HPE and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.31 IA/PA =================== hpuxws22APACHE.APACHE hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_PERL hpuxws22APACHE.PHP hpuxws22APACHE.WEBPROXY action: install revision B.2.2.29.02 or subsequent hpuxws22TOMCAT.TOMCAT action: install revision C.6.0.43.01 or subsequent HP-UX B.11.31 PA ================ hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.29.02 or subsequent HP-UX B.11.23 IA/PA =================== hpuxws22WEBMIN.HPDOCS hpuxws22WEBMIN.WEBMIN action: install revision A.1.070.13 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 7 January 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. For the oldstable distribution (wheezy), these problems have been fixed in version 31.8.0-1~deb7u1. For the stable distribution (jessie), these problems have been fixed in version 31.8.0-1~deb8u1. For the unstable distribution (sid), these problems will be fixed shortly

Trust: 1.98

sources: NVD: CVE-2015-4000 // BID: 75652 // PACKETSTORM: 169629 // PACKETSTORM: 132817 // PACKETSTORM: 132943 // PACKETSTORM: 132620 // PACKETSTORM: 133990 // PACKETSTORM: 136975 // PACKETSTORM: 135172 // PACKETSTORM: 132921 // PACKETSTORM: 133391

AFFECTED PRODUCTS

vendor:susemodel:linux enterprise serverscope:eqversion:12

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.10

Trust: 1.0

vendor:mozillamodel:network security servicesscope:eqversion:3.19

Trust: 1.0

vendor:mozillamodel:firefox osscope:eqversion:2.2

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.7.0

Trust: 1.0

vendor:opensslmodel:opensslscope:lteversion:1.0.2a

Trust: 1.0

vendor:mozillamodel:firefoxscope:eqversion:38.1.0

Trust: 1.0

vendor:susemodel:linux enterprise desktopscope:eqversion:12

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.6.0

Trust: 1.0

vendor:ibmmodel:content managerscope:eqversion:8.5

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.8.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:mozillamodel:thunderbirdscope:eqversion:38.1

Trust: 1.0

vendor:microsoftmodel:internet explorerscope:eqversion: -

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.04

Trust: 1.0

vendor:operamodel:browserscope:eqversion: -

Trust: 1.0

vendor:mozillamodel:thunderbirdscope:eqversion:31.8

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:8.3

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:12.04

Trust: 1.0

vendor:opensslmodel:opensslscope:gteversion:1.0.2

Trust: 1.0

vendor:oraclemodel:jrockitscope:eqversion:r28.3.6

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.7.0

Trust: 1.0

vendor:applemodel:safariscope:eqversion: -

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.6.0

Trust: 1.0

vendor:mozillamodel:firefox esrscope:eqversion:31.8

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:7.0

Trust: 1.0

vendor:mozillamodel:firefoxscope:eqversion:39.0

Trust: 1.0

vendor:opensslmodel:opensslscope:lteversion:1.0.1m

Trust: 1.0

vendor:opensslmodel:opensslscope:gteversion:1.0.1

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.10.3

Trust: 1.0

vendor:susemodel:linux enterprise software development kitscope:eqversion:12

Trust: 1.0

vendor:mozillamodel:firefoxscope:eqversion: -

Trust: 1.0

vendor:googlemodel:chromescope:eqversion: -

Trust: 1.0

vendor:mozillamodel:seamonkeyscope:eqversion:2.35

Trust: 1.0

vendor:hpmodel:hp-uxscope:eqversion:b.11.31

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.8.0

Trust: 1.0

vendor:oraclemodel:sparc-opl service processorscope:lteversion:1121

Trust: 1.0

vendor:susemodel:linux enterprise serverscope:eqversion:11.0

Trust: 1.0

vendor:junipermodel:junos 12.1x44-d20scope: - version: -

Trust: 0.9

vendor:junipermodel:junos 12.1x46-d25scope: - version: -

Trust: 0.6

vendor:ibmmodel:sdk for node.jsscope:eqversion:1.2.0.3

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3361mscope: - version: -

Trust: 0.3

vendor:ciscomodel:registered envelope servicescope:eqversion:0

Trust: 0.3

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.53

Trust: 0.3

vendor:hpmodel:hp-ux b.11.22scope: - version: -

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d33scope: - version: -

Trust: 0.3

vendor:ibmmodel:i v5r4scope:eqversion:6.1

Trust: 0.3

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:8.2

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d25scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.1r3scope: - version: -

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:9.1.1

Trust: 0.3

vendor:oraclemodel:enterprise manager base platformscope:eqversion:12.1.0.4

Trust: 0.3

vendor:ibmmodel:worklight foundation consumer editionscope:eqversion:6.20

Trust: 0.3

vendor:junipermodel:junos 13.3r5scope: - version: -

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.35

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.1209

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:9.1.0.4

Trust: 0.3

vendor:ibmmodel:i v5r3scope:eqversion:6.1

Trust: 0.3

vendor:ibmmodel:netinsightscope:eqversion:8.6.0

Trust: 0.3

vendor:oraclemodel:agile engineering data managementscope:eqversion:6.1.2.2

Trust: 0.3

vendor:ciscomodel:ios xescope:neversion:3.14

Trust: 0.3

vendor:ibmmodel:rational automation framework ifix5scope:neversion:3.0.1.3

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d35scope: - version: -

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.3361

Trust: 0.3

vendor:ibmmodel:rational automation frameworkscope:eqversion:3.0.1.1

Trust: 0.3

vendor:oraclemodel:jd edwards enterpriseone toolsscope:eqversion:9.2

Trust: 0.3

vendor:hpmodel:hp-ux b.11.04scope: - version: -

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.13-34

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d51scope: - version: -

Trust: 0.3

vendor:ciscomodel:prime license managerscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:worklight foundation enterprise editionscope:eqversion:6.20

Trust: 0.3

vendor:ciscomodel:agent for openflowscope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d34scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r6scope: - version: -

Trust: 0.3

vendor:ibmmodel:rational automation frameworkscope:eqversion:3.0.1.3

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.1

Trust: 0.3

vendor:hpmodel:imc productsscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:digital media players series 5.4 rbscope:neversion:4400

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d10scope: - version: -

Trust: 0.3

vendor:ciscomodel:digital media players seriesscope:eqversion:44000

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.16-37

Trust: 0.3

vendor:ciscomodel:digital media players 5.3 rbscope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d50scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 14.1r4scope: - version: -

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:9.11

Trust: 0.3

vendor:ibmmodel:rational application developer for webspherescope:eqversion:9.1.1

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:eqversion:11.1

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d15scope: - version: -

Trust: 0.3

vendor:ibmmodel:rational application developer for webspherescope:eqversion:9.1

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.4-23

Trust: 0.3

vendor:ciscomodel:prime collaboration provisioningscope:neversion:10.0

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.25-57

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.18-43

Trust: 0.3

vendor:ciscomodel:telepresence conductor xc4.0scope:neversion: -

Trust: 0.3

vendor:ciscomodel:ios xescope:neversion:3.16

Trust: 0.3

vendor:ibmmodel:security appscan enterprisescope:eqversion:9.0.1

Trust: 0.3

vendor:oraclemodel:ethernet switch es2-64scope:neversion:2.0.0.6

Trust: 0.3

vendor:ciscomodel:ios xescope:neversion:3.15

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:eqversion:11.1.3

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.913

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d20scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 12.3r2scope: - version: -

Trust: 0.3

vendor:ibmmodel:aspera enterprise serverscope:eqversion:3.5.5

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.20

Trust: 0.3

vendor:junipermodel:junos d30scope:eqversion:12.1x44

Trust: 0.3

vendor:ciscomodel:local collector appliancescope:eqversion:0

Trust: 0.3

vendor:ibmmodel:mobilefirst platform foundationscope:eqversion:6.3.0.0

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:neversion:12.2

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.11-28

Trust: 0.3

vendor:ibmmodel:security appscan enterprisescope:eqversion:9.0.2

Trust: 0.3

vendor:oraclemodel:ethernet switch es2-72scope:neversion:2.0.0.6

Trust: 0.3

vendor:junipermodel:junos 15.1r2scope:neversion: -

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.36

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3350mscope: - version: -

Trust: 0.3

vendor:junipermodel:junos 14.2r1scope: - version: -

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.3

Trust: 0.3

vendor:ciscomodel:prime collaboration provisioningscope:neversion:10.5.1

Trust: 0.3

vendor:junipermodel:junos 14.1r2scope: - version: -

Trust: 0.3

vendor:oraclemodel:ethernet switch es2-64scope:eqversion:1.9.1

Trust: 0.3

vendor:oraclemodel:enterprise manager base platformscope:eqversion:12.1.0.5

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.34

Trust: 0.3

vendor:ciscomodel:digital media players 5.4 rbscope:neversion: -

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.5

Trust: 0.3

vendor:ibmmodel:rational automation frameworkscope:eqversion:3.0.1

Trust: 0.3

vendor:oraclemodel:jd edwards world security a9.4scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.3r4scope: - version: -

Trust: 0.3

vendor:oraclemodel:sun blade ethernet switched nem 24p 10gescope:eqversion:60000

Trust: 0.3

vendor:ciscomodel:packet tracerscope:eqversion:5.2

Trust: 0.3

vendor:ciscomodel:registered envelope servicescope:neversion:4.4.1

Trust: 0.3

vendor:ibmmodel:aspera orchestratorscope:eqversion:2.3

Trust: 0.3

vendor:junipermodel:junos 12.3r6scope: - version: -

Trust: 0.3

vendor:oraclemodel:ethernet switch es2-72scope:eqversion:1.9.1

Trust: 0.3

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.54

Trust: 0.3

vendor:ciscomodel:partner supporting servicescope:eqversion:0

Trust: 0.3

vendor:oraclemodel:oss support toolsscope:eqversion:8.9.15.9.8

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d20scope: - version: -

Trust: 0.3

vendor:ibmmodel:worklight consumer editionscope:eqversion:6.1.0.0

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.15-36

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d55scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos d40scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d30.4scope: - version: -

Trust: 0.3

vendor:ciscomodel:prime collaboration deploymentscope:eqversion:0

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.1pscope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 15.1r1scope: - version: -

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3379mscope: - version: -

Trust: 0.3

vendor:ciscomodel:packet tracerscope:eqversion:5.3

Trust: 0.3

vendor:junipermodel:junos d20scope:eqversion:12.1x44

Trust: 0.3

vendor:hpmodel:comware productsscope:eqversion:50

Trust: 0.3

vendor:ciscomodel:prime network services controller 3.4.1cscope:neversion: -

Trust: 0.3

vendor:ibmmodel:rational application developer for webspherescope:eqversion:9.1.0.1

Trust: 0.3

vendor:oraclemodel:endeca serverscope:eqversion:7.6.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.16.09scope: - version: -

Trust: 0.3

vendor:oraclemodel:integrated lights out managerscope:eqversion:3.2

Trust: 0.3

vendor:ciscomodel:jabber software development kitscope:eqversion:0

Trust: 0.3

vendor:slackwaremodel:linux x86 64scope:eqversion:14.1

Trust: 0.3

vendor:ibmmodel:rational automation frameworkscope:eqversion:3.0.1.2

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.21

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d10scope: - version: -

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.1768

Trust: 0.3

vendor:oraclemodel:business intelligence enterprise editionscope:eqversion:11.1.1.9

Trust: 0.3

vendor:ciscomodel:webex messenger service ep1scope:neversion:7.9.9

Trust: 0.3

vendor:ibmmodel:sdk for node.jsscope:eqversion:1.1.0.15

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:9.1

Trust: 0.3

vendor:oraclemodel:switch es1-24scope:eqversion:0

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:1.0.2919

Trust: 0.3

vendor:ibmmodel:worklight enterprise editionscope:eqversion:6.1.0.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.13.14scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 14.1r6scope:neversion: -

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.15

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.25

Trust: 0.3

vendor:hpmodel:comware productsscope:eqversion:70

Trust: 0.3

vendor:ibmmodel:worklight consumer editionscope:eqversion:6.1.0.2

Trust: 0.3

vendor:oraclemodel:integrated lights out managerscope:eqversion:3.0

Trust: 0.3

vendor:ciscomodel:ios xescope:neversion:3.13

Trust: 0.3

vendor:freebsdmodel:10.1-stablescope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux b.11.23.1.007scope: - version: -

Trust: 0.3

vendor:oraclemodel:endeca serverscope:eqversion:7.5.0

Trust: 0.3

vendor:oraclemodel:sun network 10ge switch 72pscope:eqversion:0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11scope: - version: -

Trust: 0.3

vendor:oraclemodel:integrated lights out managerscope:eqversion:3.1

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:8.5

Trust: 0.3

vendor:ciscomodel:prime security managerscope:neversion:9.3.4.2-4

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:14.1

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.29-9

Trust: 0.3

vendor:oraclemodel:business intelligence enterprise editionscope:eqversion:11.1.1.7

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:8.6

Trust: 0.3

vendor:ciscomodel:industrial routerscope:eqversion:9100

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:9.0

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3352mscope: - version: -

Trust: 0.3

vendor:ciscomodel:security manager sp1scope:neversion:4.8

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:neversion:12.1.4

Trust: 0.3

vendor:ibmmodel:rational tau interim fixscope:eqversion:4.3.0.6

Trust: 0.3

vendor:ciscomodel:nexus series switchesscope:eqversion:50000

Trust: 0.3

vendor:ibmmodel:infosphere information serverscope:eqversion:11.3

Trust: 0.3

vendor:ciscomodel:local collector appliancescope:neversion:2.2.10

Trust: 0.3

vendor:ibmmodel:i v5r4scope:eqversion:7.1

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.0

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.1nscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.1oscope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d26scope: - version: -

Trust: 0.3

vendor:slackwaremodel:linux x86 64 -currentscope: - version: -

Trust: 0.3

vendor:slackwaremodel:linuxscope:eqversion:14.0

Trust: 0.3

vendor:junipermodel:junos 14.2r2scope: - version: -

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:neversion:12.3

Trust: 0.3

vendor:ibmmodel:i v5r3scope:eqversion:7.1

Trust: 0.3

vendor:ciscomodel:digital media playersscope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos d10scope:eqversion:12.1x44

Trust: 0.3

vendor:hpmodel:hp-ux b.11.23scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d35scope: - version: -

Trust: 0.3

vendor:ibmmodel:i v5r4scope:eqversion:7.2

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.2

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.02.008scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d25scope: - version: -

Trust: 0.3

vendor:ibmmodel:netezza host managementscope:eqversion:5.3.2.0

Trust: 0.3

vendor:ciscomodel:prime network services controllerscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:i v5r3scope:eqversion:7.2

Trust: 0.3

vendor:ibmmodel:aspera point to pointscope:eqversion:3.5.5

Trust: 0.3

vendor:ciscomodel:webex messenger servicescope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d55scope:neversion: -

Trust: 0.3

vendor:ibmmodel:netinsightscope:neversion:8.6.0.14

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d11scope: - version: -

Trust: 0.3

vendor:junipermodel:junos d25scope:eqversion:12.1x46

Trust: 0.3

vendor:junipermodel:junos 12.3r3scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r7scope: - version: -

Trust: 0.3

vendor:ciscomodel:security managerscope:eqversion:0

Trust: 0.3

vendor:huaweimodel:esight network v300r003c10spc201scope:neversion: -

Trust: 0.3

vendor:oraclemodel:agile engineering data managementscope:eqversion:6.1.3.0

Trust: 0.3

vendor:ciscomodel:socialminerscope:neversion:11.5.1

Trust: 0.3

vendor:junipermodel:junos 14.2r4scope:neversion: -

Trust: 0.3

vendor:oraclemodel:endeca serverscope:eqversion:7.3.0

Trust: 0.3

vendor:ibmmodel:aspera faspex applicationscope:eqversion:3.9.2

Trust: 0.3

vendor:ciscomodel:asa cx and cisco prime security managerscope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d40scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d20scope: - version: -

Trust: 0.3

vendor:junipermodel:junos d25scope:eqversion:12.1x44

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d20scope: - version: -

Trust: 0.3

vendor:ciscomodel:socialminerscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:8.1

Trust: 0.3

vendor:ciscomodel:prime collaboration provisioningscope:neversion:10.6

Trust: 0.3

vendor:ibmmodel:security appscan enterprisescope:eqversion:9.0

Trust: 0.3

vendor:ciscomodel:model d9485 davic qpskscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.24

Trust: 0.3

vendor:junipermodel:junos d35scope:eqversion:12.1x44

Trust: 0.3

vendor:hpmodel:vcx productsscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:agile engineering data managementscope:eqversion:6.2.0.0

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d45scope:neversion: -

Trust: 0.3

vendor:ciscomodel:nexus series fexscope:eqversion:20000

Trust: 0.3

vendor:oraclemodel:tuxedoscope:eqversion:12.1.1.0

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3381mscope: - version: -

Trust: 0.3

vendor:ciscomodel:prime collaboration provisioningscope:neversion:9.5

Trust: 0.3

vendor:ibmmodel:netezza host managementscope:eqversion:5.3.3

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d40scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d30scope: - version: -

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:neversion:12.2.1

Trust: 0.3

vendor:ibmmodel:rational tau interim fixscope:neversion:4.3.0.6

Trust: 0.3

vendor:ciscomodel:digital media players series 5.4 rbscope:neversion:4300

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d30scope: - version: -

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.17.02scope: - version: -

Trust: 0.3

vendor:ciscomodel:prime security managerscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.18-49

Trust: 0.3

vendor:ibmmodel:infosphere information serverscope:eqversion:9.1

Trust: 0.3

vendor:hpmodel:hp-ux b.11.00scope: - version: -

Trust: 0.3

vendor:ciscomodel:virtual security gatewayscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:puredata system for analyticsscope:eqversion:1.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.31scope: - version: -

Trust: 0.3

vendor:ciscomodel:industrial router 1.2.1rb3scope:neversion:910

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.13-41

Trust: 0.3

vendor:ibmmodel:aspera consolescope:eqversion:3.0.1

Trust: 0.3

vendor:slackwaremodel:linux x86 64scope:eqversion:14.0

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.31

Trust: 0.3

vendor:hpmodel:hp-ux b.11.23.07.04scope: - version: -

Trust: 0.3

vendor:ibmmodel:netezza host managementscope:neversion:5.3.7.0

Trust: 0.3

vendor:ciscomodel:unified attendant console standardscope:eqversion:0

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2dscope:neversion: -

Trust: 0.3

vendor:ibmmodel:contactoptimizationscope:eqversion:8.3

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d10scope: - version: -

Trust: 0.3

vendor:oraclemodel:jd edwards enterpriseone toolsscope:eqversion:9.1

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.3381

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:3.9-34

Trust: 0.3

vendor:ciscomodel:digital media players seriesscope:eqversion:43000

Trust: 0.3

vendor:ibmmodel:security proventia network active bypass 0343c3cscope: - version: -

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.23

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d40scope:neversion: -

Trust: 0.3

vendor:ibmmodel:infosphere information serverscope:eqversion:8.5

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:eqversion:12.1

Trust: 0.3

vendor:junipermodel:junos 12.3r11scope:neversion: -

Trust: 0.3

vendor:ibmmodel:aspera proxyscope:eqversion:1.2.2

Trust: 0.3

vendor:ciscomodel:prime collaboration provisioningscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:worklight consumer editionscope:eqversion:6.1.0.1

Trust: 0.3

vendor:junipermodel:junos 13.3r7scope:neversion: -

Trust: 0.3

vendor:huaweimodel:esight network v300r003c10spc100scope: - version: -

Trust: 0.3

vendor:junipermodel:junosscope:eqversion:12.1x47

Trust: 0.3

vendor:ibmmodel:aspera sharesscope:eqversion:1.9.2

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:11.2

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d10scope: - version: -

Trust: 0.3

vendor:oraclemodel:switch es1-24scope:eqversion:1.3

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.3376

Trust: 0.3

vendor:oraclemodel:endeca serverscope:eqversion:7.4

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:2.18-42

Trust: 0.3

vendor:ibmmodel:worklight enterprise editionscope:eqversion:6.1.0.2

Trust: 0.3

vendor:junipermodel:junos 14.1r5scope: - version: -

Trust: 0.3

vendor:ibmmodel:sdk for node.jsscope:eqversion:1.2.0.4

Trust: 0.3

vendor:ibmmodel:aspera enterprise server clientscope:eqversion:3.5.5

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:9.1.1

Trust: 0.3

vendor:ibmmodel:worklight foundation consumer editionscope:eqversion:6.2.0.1

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.16

Trust: 0.3

vendor:ibmmodel:aspera ondemandscope:eqversion:3.5.4

Trust: 0.3

vendor:slackwaremodel:linux -currentscope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3r9scope: - version: -

Trust: 0.3

vendor:ciscomodel:telepresence conductorscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:9.1

Trust: 0.3

vendor:ibmmodel:security proventia network active bypassscope:eqversion:1.0.1876

Trust: 0.3

vendor:ciscomodel:digital media players series 5.3 rbscope:neversion:4300

Trust: 0.3

vendor:ibmmodel:worklight enterprise editionscope:eqversion:6.1.0.1

Trust: 0.3

vendor:ciscomodel:connected analytics for collaborationscope:eqversion:0

Trust: 0.3

vendor:hpmodel:cloud service automationscope:eqversion:4.5

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d26scope: - version: -

Trust: 0.3

vendor:ibmmodel:worklight foundation enterprise editionscope:eqversion:6.2.0.1

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.14.15scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex node for mcsscope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d35.5scope: - version: -

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.3x48-d30scope:neversion: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2cscope: - version: -

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.32

Trust: 0.3

vendor:ciscomodel:virtual security gateway for microsoft hyper-vscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:sun blade ethernet switched nem 24p 10gescope:neversion:60001.2.2.13

Trust: 0.3

vendor:ciscomodel:services analytic platformscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:switch es1-24scope:neversion:1.3.1.3

Trust: 0.3

vendor:ciscomodel:security managerscope:neversion:4.9

Trust: 0.3

vendor:ibmmodel:security network controller 1.0.3376mscope: - version: -

Trust: 0.3

vendor:ibmmodel:infosphere information serverscope:eqversion:8.1

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.3

Trust: 0.3

vendor:ibmmodel:security network controllerscope:eqversion:1.0.3379

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d15scope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2bscope: - version: -

Trust: 0.3

vendor:oraclemodel:mysql serverscope:eqversion:5.6.22

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d36scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d25scope: - version: -

Trust: 0.3

vendor:ciscomodel:network performance analyticsscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:mobilefirst platform foundationscope:eqversion:7.0.0.0

Trust: 0.3

vendor:hpmodel:hp-ux b.11.11.15.13scope: - version: -

Trust: 0.3

vendor:ciscomodel:emergency responderscope: - version: -

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:8.6

Trust: 0.3

vendor:ibmmodel:campaignscope:eqversion:9.0

Trust: 0.3

vendor:ibmmodel:infosphere information serverscope:eqversion:8.7

Trust: 0.3

vendor:junipermodel:junos 15.1x49-d20scope:neversion: -

Trust: 0.3

vendor:junipermodel:junos 14.2r3scope: - version: -

Trust: 0.3

vendor:ciscomodel:model d9485 davic qpskscope:neversion:1.2.19

Trust: 0.3

vendor:oraclemodel:enterprise manager ops centerscope:eqversion:12.1.0.1

Trust: 0.3

vendor:ibmmodel:rational tauscope:eqversion:4.33

Trust: 0.3

vendor:ibmmodel:netezza host managementscope:eqversion:5.3.6.0

Trust: 0.3

vendor:junipermodel:junos 12.1x46-d15scope: - version: -

Trust: 0.3

vendor:oraclemodel:sun network 10ge switch 72pscope:neversion:1.2.2.15

Trust: 0.3

vendor:junipermodel:junos 12.1x47-d15scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d32scope: - version: -

Trust: 0.3

vendor:junipermodel:junos 13.2x51-d30scope: - version: -

Trust: 0.3

vendor:ciscomodel:im and presence servicescope:eqversion:0

Trust: 0.3

vendor:junipermodel:junos 12.3r10scope: - version: -

Trust: 0.3

vendor:ciscomodel:digital media players series 5.3 rbscope:neversion:4400

Trust: 0.3

vendor:junipermodel:junos 12.1x44-d15scope: - version: -

Trust: 0.3

sources: BID: 75652 // NVD: CVE-2015-4000

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-4000
value: LOW

Trust: 1.0

nvd@nist.gov: CVE-2015-4000
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

nvd@nist.gov: CVE-2015-4000
baseSeverity: LOW
baseScore: 3.7
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 1.4
version: 3.0

Trust: 1.0

sources: NVD: CVE-2015-4000

PROBLEMTYPE DATA

problemtype:CWE-310

Trust: 1.0

sources: NVD: CVE-2015-4000

THREAT TYPE

network

Trust: 0.3

sources: BID: 75652

TYPE

Input Validation Error

Trust: 0.3

sources: BID: 75652

EXTERNAL IDS

db:NVDid:CVE-2015-4000

Trust: 2.2

db:SECTRACKid:1033064

Trust: 1.0

db:SECTRACKid:1033891

Trust: 1.0

db:SECTRACKid:1032960

Trust: 1.0

db:SECTRACKid:1032476

Trust: 1.0

db:SECTRACKid:1040630

Trust: 1.0

db:SECTRACKid:1033760

Trust: 1.0

db:SECTRACKid:1033019

Trust: 1.0

db:SECTRACKid:1033513

Trust: 1.0

db:SECTRACKid:1032655

Trust: 1.0

db:SECTRACKid:1032932

Trust: 1.0

db:SECTRACKid:1032654

Trust: 1.0

db:SECTRACKid:1032910

Trust: 1.0

db:SECTRACKid:1032777

Trust: 1.0

db:SECTRACKid:1032784

Trust: 1.0

db:SECTRACKid:1033209

Trust: 1.0

db:SECTRACKid:1032884

Trust: 1.0

db:SECTRACKid:1032653

Trust: 1.0

db:SECTRACKid:1032637

Trust: 1.0

db:SECTRACKid:1032649

Trust: 1.0

db:SECTRACKid:1033067

Trust: 1.0

db:SECTRACKid:1033991

Trust: 1.0

db:SECTRACKid:1036218

Trust: 1.0

db:SECTRACKid:1033210

Trust: 1.0

db:SECTRACKid:1032856

Trust: 1.0

db:SECTRACKid:1032648

Trust: 1.0

db:SECTRACKid:1034884

Trust: 1.0

db:SECTRACKid:1033341

Trust: 1.0

db:SECTRACKid:1032475

Trust: 1.0

db:SECTRACKid:1032647

Trust: 1.0

db:SECTRACKid:1032688

Trust: 1.0

db:SECTRACKid:1033222

Trust: 1.0

db:SECTRACKid:1033430

Trust: 1.0

db:SECTRACKid:1033433

Trust: 1.0

db:SECTRACKid:1033065

Trust: 1.0

db:SECTRACKid:1033385

Trust: 1.0

db:SECTRACKid:1032871

Trust: 1.0

db:SECTRACKid:1032699

Trust: 1.0

db:SECTRACKid:1033208

Trust: 1.0

db:SECTRACKid:1032783

Trust: 1.0

db:SECTRACKid:1032650

Trust: 1.0

db:SECTRACKid:1034087

Trust: 1.0

db:SECTRACKid:1032474

Trust: 1.0

db:SECTRACKid:1034728

Trust: 1.0

db:SECTRACKid:1032645

Trust: 1.0

db:SECTRACKid:1032727

Trust: 1.0

db:SECTRACKid:1032759

Trust: 1.0

db:SECTRACKid:1032702

Trust: 1.0

db:SECTRACKid:1032652

Trust: 1.0

db:SECTRACKid:1032864

Trust: 1.0

db:SECTRACKid:1032651

Trust: 1.0

db:SECTRACKid:1032778

Trust: 1.0

db:SECTRACKid:1032656

Trust: 1.0

db:SECTRACKid:1033416

Trust: 1.0

db:SECTRACKid:1032865

Trust: 1.0

db:BIDid:91787

Trust: 1.0

db:BIDid:74733

Trust: 1.0

db:OPENWALLid:OSS-SECURITY/2015/05/20/8

Trust: 1.0

db:SIEMENSid:SSA-412672

Trust: 1.0

db:JUNIPERid:JSA10727

Trust: 1.0

db:JUNIPERid:JSA10681

Trust: 1.0

db:MCAFEEid:SB10122

Trust: 1.0

db:JUNIPERid:JSA10694

Trust: 0.3

db:BIDid:75652

Trust: 0.3

db:PACKETSTORMid:169629

Trust: 0.1

db:PACKETSTORMid:132817

Trust: 0.1

db:PACKETSTORMid:132943

Trust: 0.1

db:PACKETSTORMid:132620

Trust: 0.1

db:PACKETSTORMid:133990

Trust: 0.1

db:PACKETSTORMid:136975

Trust: 0.1

db:PACKETSTORMid:135172

Trust: 0.1

db:PACKETSTORMid:132921

Trust: 0.1

db:PACKETSTORMid:133391

Trust: 0.1

sources: BID: 75652 // PACKETSTORM: 169629 // PACKETSTORM: 132817 // PACKETSTORM: 132943 // PACKETSTORM: 132620 // PACKETSTORM: 133990 // PACKETSTORM: 136975 // PACKETSTORM: 135172 // PACKETSTORM: 132921 // PACKETSTORM: 133391 // NVD: CVE-2015-4000

REFERENCES

url:http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Trust: 1.3

url:http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Trust: 1.3

url:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Trust: 1.3

url:https://www.openssl.org/news/secadv_20150611.txt

Trust: 1.1

url:http://rhn.redhat.com/errata/rhsa-2015-1488.html

Trust: 1.1

url:http://rhn.redhat.com/errata/rhsa-2015-1544.html

Trust: 1.1

url:http://www.ubuntu.com/usn/usn-2656-1

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=144060606031437&w=2

Trust: 1.0

url:http://lists.fedoraproject.org/pipermail/package-announce/2015-june/159351.html

Trust: 1.0

url:http://www.securityfocus.com/bid/91787

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143637549705650&w=2

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144060576831314&w=2

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21962816

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959539

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1485.html

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1526.html

Trust: 1.0

url:http://www.securityfocus.com/bid/74733

Trust: 1.0

url:https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1072.html

Trust: 1.0

url:http://www.debian.org/security/2016/dsa-3688

Trust: 1.0

url:http://www.securitytracker.com/id/1036218

Trust: 1.0

url:https://openssl.org/news/secadv/20150611.txt

Trust: 1.0

url:http://www.solarwinds.com/documentation/storage/storagemanager/docs/releasenotes/releasenotes.htm

Trust: 1.0

url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10681

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959325

Trust: 1.0

url:http://www.debian.org/security/2015/dsa-3316

Trust: 1.0

url:http://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04949778

Trust: 1.0

url:http://www.securitytracker.com/id/1032932

Trust: 1.0

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04953655

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21962455

Trust: 1.0

url:http://openwall.com/lists/oss-security/2015/05/20/8

Trust: 1.0

url:https://weakdh.org/imperfect-forward-secrecy.pdf

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144102017024820&w=2

Trust: 1.0

url:http://www.securitytracker.com/id/1032652

Trust: 1.0

url:http://www.securitytracker.com/id/1034087

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04770140

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04832246

Trust: 1.0

url:http://www.securitytracker.com/id/1034884

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21960194

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04773241

Trust: 1.0

url:https://developer.mozilla.org/en-us/docs/mozilla/projects/nss/nss_3.19.1_release_notes

Trust: 1.0

url:http://support.citrix.com/article/ctx201114

Trust: 1.0

url:https://support.citrix.com/article/ctx216642

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1230.html

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1486.html

Trust: 1.0

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05128722

Trust: 1.0

url:http://lists.apple.com/archives/security-announce/2015/jun/msg00001.html

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21958984

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04918839

Trust: 1.0

url:http://www.securitytracker.com/id/1033067

Trust: 1.0

url:https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5098403

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032727

Trust: 1.0

url:http://www.securitytracker.com/id/1033891

Trust: 1.0

url:http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144043644216842&w=2

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2016-1624.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032475

Trust: 1.0

url:http://www.securitytracker.com/id/1032777

Trust: 1.0

url:http://www.securitytracker.com/id/1033209

Trust: 1.0

url:https://security.gentoo.org/glsa/201603-11

Trust: 1.0

url:http://www.securitytracker.com/id/1033433

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144069189622016&w=2

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04926789

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html

Trust: 1.0

url:http://www.debian.org/security/2015/dsa-3324

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144104533800819&w=2

Trust: 1.0

url:http://support.apple.com/kb/ht204941

Trust: 1.0

url:http://www.securitytracker.com/id/1033385

Trust: 1.0

url:http://www.mozilla.org/security/announce/2015/mfsa2015-70.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032648

Trust: 1.0

url:http://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04876402

Trust: 1.0

url:http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032884

Trust: 1.0

url:http://www.ubuntu.com/usn/usn-2696-1

Trust: 1.0

url:http://www.securitytracker.com/id/1032651

Trust: 1.0

url:http://lists.apple.com/archives/security-announce/2015/jun/msg00002.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143506486712441&w=2

Trust: 1.0

url:http://www.securitytracker.com/id/1033064

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html

Trust: 1.0

url:http://support.apple.com/kb/ht204942

Trust: 1.0

url:http://www.securitytracker.com/id/1032474

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21960380

Trust: 1.0

url:https://puppet.com/security/cve/cve-2015-4000

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1185.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033208

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04923929

Trust: 1.0

url:https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbhf03831en_us

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html

Trust: 1.0

url:http://www.debian.org/security/2015/dsa-3287

Trust: 1.0

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04740527

Trust: 1.0

url:http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc

Trust: 1.0

url:https://bto.bluecoat.com/security-advisory/sa98

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033341

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html

Trust: 1.0

url:http://www.securitytracker.com/id/1040630

Trust: 1.0

url:https://help.ecostruxureit.com/display/public/uadco8x/struxureware+data+center+operation+software+vulnerability+fixes

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21960041

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144050121701297&w=2

Trust: 1.0

url:https://security.gentoo.org/glsa/201506-02

Trust: 1.0

url:https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21962739

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143880121627664&w=2

Trust: 1.0

url:http://www.securitytracker.com/id/1032856

Trust: 1.0

url:http://www.ubuntu.com/usn/usn-2656-2

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032759

Trust: 1.0

url:http://lists.fedoraproject.org/pipermail/package-announce/2015-june/160117.html

Trust: 1.0

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05193083

Trust: 1.0

url:https://www-304.ibm.com/support/docview.wss?uid=swg21959745

Trust: 1.0

url:http://www.fortiguard.com/advisory/2015-05-20-logjam-attack

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21960418

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959812

Trust: 1.0

url:https://www.oracle.com/security-alerts/cpujan2021.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032702

Trust: 1.0

url:http://www.securitytracker.com/id/1032864

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html

Trust: 1.0

url:https://h20564.www2.hp.com/hpsc/doc/public/display?docid=emr_na-c04718196

Trust: 1.0

url:http://ftp.netbsd.org/pub/netbsd/security/advisories/netbsd-sa2015-008.txt.asc

Trust: 1.0

url:https://security.netapp.com/advisory/ntap-20150619-0001/

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1604.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959195

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html

Trust: 1.0

url:http://www.ubuntu.com/usn/usn-2706-1

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1241.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033019

Trust: 1.0

url:http://www.securitytracker.com/id/1033065

Trust: 1.0

url:https://kc.mcafee.com/corporate/index?page=content&id=sb10122

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1228.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143557934009303&w=2

Trust: 1.0

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05045763

Trust: 1.0

url:http://www.securitytracker.com/id/1034728

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04772190

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143655800220052&w=2

Trust: 1.0

url:http://www.debian.org/security/2015/dsa-3339

Trust: 1.0

url:http://www.debian.org/security/2015/dsa-3300

Trust: 1.0

url:http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033513

Trust: 1.0

url:http://www.securitytracker.com/id/1033430

Trust: 1.0

url:http://www.securitytracker.com/id/1032784

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2016-2056.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21960191

Trust: 1.0

url:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959453

Trust: 1.0

url:http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032653

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html

Trust: 1.0

url:http://lists.fedoraproject.org/pipermail/package-announce/2015-june/159314.html

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21967893

Trust: 1.0

url:http://www.securitytracker.com/id/1032654

Trust: 1.0

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04773119

Trust: 1.0

url:http://www.securitytracker.com/id/1033416

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959530

Trust: 1.0

url:http://www.securitytracker.com/id/1032910

Trust: 1.0

url:https://www.suse.com/security/cve/cve-2015-4000.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032871

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1242.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=145409266329539&w=2

Trust: 1.0

url:http://www.securitytracker.com/id/1032647

Trust: 1.0

url:http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html

Trust: 1.0

url:http://www-304.ibm.com/support/docview.wss?uid=swg21959132

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143558092609708&w=2

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=143628304012255&w=2

Trust: 1.0

url:https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

Trust: 1.0

url:http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21961717

Trust: 1.0

url:http://www.securitytracker.com/id/1033222

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959517

Trust: 1.0

url:https://weakdh.org/

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033210

Trust: 1.0

url:https://bugzilla.mozilla.org/show_bug.cgi?id=1138554

Trust: 1.0

url:http://www.securitytracker.com/id/1032960

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144493176821532&w=2

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959636

Trust: 1.0

url:http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032699

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1229.html

Trust: 1.0

url:http://marc.info/?l=bugtraq&m=144061542602287&w=2

Trust: 1.0

url:http://www.securitytracker.com/id/1032656

Trust: 1.0

url:http://www.securitytracker.com/id/1032778

Trust: 1.0

url:http://www.securitytracker.com/id/1032688

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959111

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1243.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032645

Trust: 1.0

url:http://www.securitytracker.com/id/1033760

Trust: 1.0

url:http://www.securitytracker.com/id/1032649

Trust: 1.0

url:http://www.securitytracker.com/id/1032637

Trust: 1.0

url:http://www.securitytracker.com/id/1032783

Trust: 1.0

url:http://www.securitytracker.com/id/1032655

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html

Trust: 1.0

url:http://www.securitytracker.com/id/1032476

Trust: 1.0

url:http://www.securitytracker.com/id/1032650

Trust: 1.0

url:http://www.ubuntu.com/usn/usn-2673-1

Trust: 1.0

url:http://www.securitytracker.com/id/1032865

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html

Trust: 1.0

url:http://www-01.ibm.com/support/docview.wss?uid=swg21959481

Trust: 1.0

url:https://security.gentoo.org/glsa/201701-46

Trust: 1.0

url:https://security.gentoo.org/glsa/201512-10

Trust: 1.0

url:http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html

Trust: 1.0

url:http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html

Trust: 1.0

url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10727

Trust: 1.0

url:http://rhn.redhat.com/errata/rhsa-2015-1197.html

Trust: 1.0

url:http://www.securitytracker.com/id/1033991

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2015-4000

Trust: 0.9

url:https://mta.openssl.org/pipermail/openssl-announce/2015-july/000037.html

Trust: 0.3

url:http://openssl.org/

Trust: 0.3

url:https://support.asperasoft.com/entries/94843988-security-bulletin-openssl-,-tls-vulnerabilities-logjam-cve-2015-4000

Trust: 0.3

url:http://seclists.org/bugtraq/2015/aug/13

Trust: 0.3

url:http://kb.juniper.net/infocenter/index?page=content&id=jsa10694

Trust: 0.3

url:https://www.openssl.org/news/secadv_20150709.txt

Trust: 0.3

url:http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html

Trust: 0.3

url:http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

Trust: 0.3

url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04822825

Trust: 0.3

url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05184351

Trust: 0.3

url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20150710-openssl

Trust: 0.3

url:http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-454058.htm

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21962519

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21964231

Trust: 0.3

url:https://www-304.ibm.com/support/docview.wss?uid=swg21965399

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=nas8n1020840

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21961179

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21962398

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21962929

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21963448

Trust: 0.3

url:https://www.openssl.org/news/vulnerabilities.html#2015-1793

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21963498

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21966481

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21966484

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21965725

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21965807

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-2808

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-4732

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4760

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2621

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2601

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4732

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4760

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2601

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2632

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4000

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2664

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2632

Trust: 0.2

url:https://bugzilla.redhat.com/show_bug.cgi?id=1223211#c33

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2621

Trust: 0.2

url:https://access.redhat.com/articles/11258

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-1931

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4733

Trust: 0.2

url:http://www.ibm.com/developerworks/java/jdk/alerts/

Trust: 0.2

url:https://access.redhat.com/security/team/contact/

Trust: 0.2

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2638

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4748

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4731

Trust: 0.2

url:https://bugzilla.redhat.com/):

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2638

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4749

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-1931

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2590

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2664

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4733

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4749

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2590

Trust: 0.2

url:https://access.redhat.com/security/team/key/

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2637

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4731

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4748

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2637

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2740

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2737

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2721

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2739

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2734

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2724

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2735

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2736

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2738

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-3183

Trust: 0.2

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/

Trust: 0.2

url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Trust: 0.2

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/

Trust: 0.2

url:https://www.hp.com/go/swa

Trust: 0.2

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n

Trust: 0.2

url:http://www.hpe.com/support/subscriber_choice

Trust: 0.2

url:http://www.hpe.com/support/security_bulletin_archive

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-1792

Trust: 0.1

url:https://www.openssl.org/about/secpolicy.html

Trust: 0.1

url:https://www.openssl.org/about/releasestrat.html),

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1789

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1790

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1788

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8176

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1791

Trust: 0.1

url:https://rt.openssl.org/ticket/display.html?id=3286

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2619

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-2613

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#critical

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4729

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-4736

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4736

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-2625

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2625

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-4729

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2613

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-2619

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.1

url:https://www.ibm.com/developerworks/java/jdk/lifecycle/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2733

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2728

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2730

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/firefox/39.0+build5-0ubuntu0.14.10.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/firefox/39.0+build5-0ubuntu0.14.04.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2727

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2725

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2731

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2741

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2726

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2722

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2729

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/firefox/39.0+build5-0ubuntu0.15.04.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2743

Trust: 0.1

url:http://software.hp.com

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0118

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0226

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5704

Trust: 0.1

url:https://h20392.www2.hpe.com/portal/swdepot/displayproductinfo.do?productnumbe

Trust: 0.1

url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04832246

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea

Trust: 0.1

sources: BID: 75652 // PACKETSTORM: 169629 // PACKETSTORM: 132817 // PACKETSTORM: 132943 // PACKETSTORM: 132620 // PACKETSTORM: 133990 // PACKETSTORM: 136975 // PACKETSTORM: 135172 // PACKETSTORM: 132921 // PACKETSTORM: 133391 // NVD: CVE-2015-4000

CREDITS

Adam Langley of Google and David Benjamin of BoringSSL.

Trust: 0.3

sources: BID: 75652

SOURCES

db:BIDid:75652
db:PACKETSTORMid:169629
db:PACKETSTORMid:132817
db:PACKETSTORMid:132943
db:PACKETSTORMid:132620
db:PACKETSTORMid:133990
db:PACKETSTORMid:136975
db:PACKETSTORMid:135172
db:PACKETSTORMid:132921
db:PACKETSTORMid:133391
db:NVDid:CVE-2015-4000

LAST UPDATE DATE

2025-03-29T20:16:28.497000+00:00


SOURCES UPDATE DATE

db:BIDid:75652date:2016-10-26T05:10:00
db:NVDid:CVE-2015-4000date:2024-11-21T02:30:14.667

SOURCES RELEASE DATE

db:BIDid:75652date:2015-07-09T00:00:00
db:PACKETSTORMid:169629date:2015-06-11T12:12:12
db:PACKETSTORMid:132817date:2015-07-23T21:49:06
db:PACKETSTORMid:132943date:2015-08-04T17:55:43
db:PACKETSTORMid:132620date:2015-07-09T23:16:31
db:PACKETSTORMid:133990date:2015-10-16T01:44:08
db:PACKETSTORMid:136975date:2016-05-12T16:07:11
db:PACKETSTORMid:135172date:2016-01-08T15:12:14
db:PACKETSTORMid:132921date:2015-08-04T01:08:37
db:PACKETSTORMid:133391date:2015-09-01T03:15:29
db:NVDid:CVE-2015-4000date:2015-05-21T00:59:00.087