Search CVE reports
41 – 50 of 189 results
Some fixes available 2 of 3
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private...
6 affected packages
nodejs, edk2, edk2-hwe, openssl, openssl-fips, openssl1.0
| Package | 24.04 LTS |
|---|---|
| nodejs | Not affected |
| edk2 | Not affected |
| edk2-hwe | Not in release |
| openssl | Not affected |
| openssl-fips | Not affected |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |
several issues with partition table measurements
2 affected packages
edk2, edk2-hwe
| Package | 24.04 LTS |
|---|---|
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
Some fixes available 2 of 3
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain...
6 affected packages
openssl-fips, edk2, edk2-hwe, nodejs, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| edk2 | Vulnerable |
| edk2-hwe | Not in release |
| nodejs | Not affected |
| openssl | Fixed |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker...
6 affected packages
openssl-fips, edk2, edk2-hwe, nodejs, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| edk2 | Vulnerable |
| edk2-hwe | Not in release |
| nodejs | Not affected |
| openssl | Fixed |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |
Some fixes available 2 of 3
Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact...
6 affected packages
openssl-fips, nodejs, edk2, edk2-hwe, openssl, openssl1.0
| Package | 24.04 LTS |
|---|---|
| openssl-fips | Fixed |
| nodejs | Not affected |
| edk2 | Needs evaluation |
| edk2-hwe | Not in release |
| openssl | Fixed |
| openssl1.0 | Not in release |