Search CVE reports
181 – 190 of 36824 results
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Fixed |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Fixed |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Some fixes available 1 of 2
Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Fixed |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Needs evaluation |
Some fixes available 1 of 2
Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Fixed |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Needs evaluation |
Some fixes available 1 of 2
Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Fixed |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Needs evaluation |
Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Not affected |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Not affected |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Not affected |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Not affected |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |
Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer...
4 affected packages
openssl, openssl1.0, nodejs, edk2
| Package | 20.04 LTS |
|---|---|
| openssl | Not affected |
| openssl1.0 | — |
| nodejs | Not affected |
| edk2 | Not affected |