CVE-2012-2110
published 2012-04-19CVE-2012-2110: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret…
PriorityP261high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
48.30%
98.7th percentile
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Affected
80 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openssl | < openssl 1.0.1a-1 (bookworm) | openssl 1.0.1a-1 (bookworm) |
| debian | openssl | — | — |
| openssl | openssl | <= 0.9.8u | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
| openssl | openssl | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect crafted DER-encoded data with a length field having the 31st bit set (e.g., length value 2147483648 / 0x80000000) supplied to OpenSSL ASN.1 parsing interfaces such as d2i_X509_bio or other d2i_* BIO wrappers — this triggers the integer sign-extension/truncation in asn1_d2i_read_bio. ↗
- →Monitor for anomalously large or negative ASN.1 length values being processed by OpenSSL — specifically a cast of c.slen (long) to a signed int producing a negative want value (e.g., c.slen=2147483648 → want=-2147483648), which precedes the heap overflow in BUF_MEM_grow_clean. ↗
- →Flag calls to CRYPTO_realloc_clean where old_len > num, indicating the buffer-shrink path that OpenSSL does not handle safely and which results in a heap overflow memcpy. ↗
- →Any application invoking d2i_* BIO interfaces (e.g., d2i_X509_bio) against untrusted input is a potential exploitation target; monitor process call stacks for asn1_d2i_read_bio → ASN1_item_d2i_bio → d2i_X509_bio chains processing externally supplied data. ↗
- ·Some attack vectors require an I32LP64 (64-bit) architecture where the sign-extension of a 32-bit signed int to size_t produces a large unexpected value; other vectors also affect 32-bit (x86) platforms. ↗
- ·Even applications that do not call d2i_* functions directly are affected, because many higher-level OpenSSL APIs invoke them internally when handling untrusted data. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library security issues.
vendor_vmware·2013-02-21·CVSS 7.6
CVE-2012-2110 [HIGH] VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library security issues.
VMSA-2013-0003: VMware vCenter Server, ESXi and ESX address an NFC Protocol memory corruption and third party library security issues.
a. VMware vCenter, ESXi and ESX NFC protocol memory corruption vulnerability VMware vCenter Server, ESXi and ESX contain a vulnerability in the handling of the Network File Copy (NFC) protocol. To exploit this vulnerability, an attacker must intercept and modify the NFC traffic between vCenter Server and the client or ESXi/ESX and the client. Exploitation of the issue may lead to code execution. To reduce the likelihood of exploitation, vSphere components should be deployed on an isolated management network VMware would like to thank Alex Chapman of Context Information Security for reporting this issue to us. The Common Vulnerabilities and Exposures projec
VMware
VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
vendor_vmware·2013-02-07·CVSS 7.2
CVE-2012-2110 [HIGH] VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
VMSA-2013-0002: VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
a. VMware VMCI privilege escalation VMware ESX, Workstation, Fusion, and View contain a vulnerability in the handling of control code in vmci.sys. A local malicious user may exploit this vulnerability to manipulate the memory allocation through the Virtual Machine Communication Interface (VMCI) code. This could result in a privilege escalation on Windows-based hosts and on Windows-based Guest Operating Systems. The vulnerability does not allow for privilege escalation from the Guest Operating System to the host (and vice versa). This means that host memory can not be manipulated from the Guest Operating System (and vice versa). Systems that have VMCI disabled are also affected by this issue.
BSD
FreeBSD-SA-12:01.openssl: OpenSSL multiple vulnerabilities
bsd_advisories·2012-05-30·CVSS 9.3
CVE-2011-4109 [CRITICAL] FreeBSD-SA-12:01.openssl: OpenSSL multiple vulnerabilities
FreeBSD-SA-12:01.openssl Security Advisory
The FreeBSD Project
Topic: OpenSSL multiple vulnerabilities
Category: contrib
Module: openssl
Announced: 2012-05-03
Credits: Adam Langley, George Kadianakis, Ben Laurie,
Ivan Nestlerode, Tavis Ormandy
Affects: All supported versions of FreeBSD.
Corrected: 2012-05-30 12:01:28 UTC (RELENG_7, 7.4-STABLE)
2012-05-30 12:01:28 UTC (RELENG_7_4, 7.4-RELEASE-p8)
2012-05-30 12:01:28 UTC (RELENG_8, 8.3-STABLE)
2012-05-30 12:01:28 UTC (RELENG_8_3, 8.3-RELEASE-p2)
2012-05-30 12:01:28 UTC (RELENG_8_2, 8.2-RELEASE-p8)
2012-05-30 12:01:28 UTC (RELENG_8_1, 8.1-RELEASE-p10)
2012-05-30 12:01:28 UTC (RELENG_9, 9.0-STABLE)
2012-05-30 12:01:28 UTC (RELENG_9_0, 9.0-RELEASE-p2)
CVE Name: CVE-2011-4576, CVE-2011-4619, CVE-2011-4109,
CVE-2012-0884, CVE-2012-2110
For gen
Ubuntu
OpenSSL vulnerability
vendor_ubuntu·2012-04-24·CVSS 7.5
CVE-2012-2131 [HIGH] OpenSSL vulnerability
Title: OpenSSL vulnerability
Summary: An application using OpenSSL could be made to crash or run programs if it
opened a specially crafted file.
It was discovered that the fix for CVE-2012-2110 was incomplete for OpenSSL
0.9.8. A remote attacker could trigger this flaw in services that used SSL
to cause a denial of service or possibly execute arbitrary code with
application privileges. Ubuntu 11.10 was not affected by this issue.
(CVE-2012-2131)
The original upstream fix for CVE-2012-2110 would cause BUF_MEM_grow_clean()
to sometimes return the wrong error condition. This update fixes the
problem.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
openssl: incomplete fix of CVE-2012-2110 for 0.9.x
vendor_redhat·2012-04-23·CVSS 7.5
CVE-2012-2131 [HIGH] openssl: incomplete fix of CVE-2012-2110 for 0.9.x
openssl: incomplete fix of CVE-2012-2110 for 0.9.x
Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.
Statement: Not vulnerable. This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 3, 4, 5 and 6, as there were no updates released with an incomplete CVE-2012-2110 fix.
Package: openssl (Red Hat Enterprise Linux 4) - Not affected
Package: openssl096b (Red Hat Enterprise Linux 4) - Not affected
Package: openssl (
Ubuntu
OpenSSL vulnerabilities
vendor_ubuntu·2012-04-19·CVSS 5.0
CVE-2006-7250 [MEDIUM] OpenSSL vulnerabilities
Title: OpenSSL vulnerabilities
Summary: An application using OpenSSL could be made to crash or run programs if it
opened a specially crafted file.
It was discovered that OpenSSL could be made to dereference a NULL pointer
when processing S/MIME messages. A remote attacker could use this to cause
a denial of service. These issues did not affect Ubuntu 8.04 LTS.
(CVE-2006-7250, CVE-2012-1165)
Tavis Ormandy discovered that OpenSSL did not properly perform bounds
checking when processing DER data via BIO or FILE functions. A remote
attacker could trigger this flaw in services that used SSL to cause a
denial of service or possibly execute arbitrary code with application
privileges. (CVE-2012-2110)
Instructions: After a standard system update you need to reboot your computer to make
all the
Red Hat
openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
vendor_redhat·2012-04-19·CVSS 7.5
CVE-2012-2110 [HIGH] CWE-681 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Package: openssl096b (Red Hat Enterprise Linux 4) - Will not fix
Package: openssl (Red Hat JBoss Enterprise Web Server 1) - Affected
Debian
CVE-2012-2110: openssl - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8...
vendor_debian·2012·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110: openssl - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8...
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Scope: local
bookworm: resolved (fixed in 1.0.1a-1)
bullseye: resolved (fixed in 1.0.1a-1)
forky: resolved (fixed in 1.0.1a-1)
sid: resolved (fixed in 1.0.1a-1)
trixie: resolved (fixed in 1.0.1a-1)
Debian
CVE-2012-2131: openssl - Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v a...
vendor_debian·2012·CVSS 7.5
CVE-2012-2131 [HIGH] CVE-2012-2131: openssl - Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v a...
Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-mm35-fwq5-v845: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp
ghsa_unreviewed·2022-05-14
CVE-2012-2110 [HIGH] CWE-119 GHSA-mm35-fwq5-v845: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
GHSA
GHSA-wvj2-94fg-jpr9: Multiple integer signedness errors in crypto/buffer/buffer
ghsa_unreviewed·2022-05-14·CVSS 7.5
CVE-2012-2131 [HIGH] GHSA-wvj2-94fg-jpr9: Multiple integer signedness errors in crypto/buffer/buffer
Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.
OSV
CVE-2012-2110: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp
osv·2012-04-19·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
No detection rules found.
Bugzilla
CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [epel-5]
bugzilla·2012-04-24·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [epel-5]
CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/upd
Bugzilla
CVE-2012-2131 openssl: incomplete fix of CVE-2012-2110 for 0.9.x
bugzilla·2012-04-24·CVSS 7.5
CVE-2012-2131 [HIGH] CVE-2012-2131 openssl: incomplete fix of CVE-2012-2110 for 0.9.x
CVE-2012-2131 openssl: incomplete fix of CVE-2012-2110 for 0.9.x
It was discovered that upstream fix for OpenSSL issue CVE-2012-2110 (see bug #814185) did not completely address the issue for OpenSSL versions 0.9.x. This incomplete fix problem did not affect versions 1.0.0 and 1.0.1, and was corrected in 0.9.8 branch in version 0.9.8w.
Upstream commit and announcement of the 0.9.8w release:
http://cvs.openssl.org/chngview?cn=22479
http://marc.info/?l=openssl-dev&m=133525318514423&w=2
Discussion:
As there were no Red Hat Enterprise Linux or Fedora updates released with an incomplete fix, they are not affected by this CVE.
Statement:
Not vulnerable. This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 3, 4, 5 and 6, as there were no updates release
Bugzilla
CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
bugzilla·2012-04-19·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates
Bugzilla
CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
bugzilla·2012-04-19·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
Quoting Tavis Ormandy's advisory "Incorrect integer conversions in OpenSSL can result in memory corruption.":
asn1_d2i_read_bio in OpenSSL contains multiple integer errors that can
cause memory corruption when parsing encoded ASN.1 data. This error can be
exploited on systems that parse untrusted data, such as X.509 certificates
or RSA public keys.
Reference:
http://seclists.org/fulldisclosure/2012/Apr/210
Tavis's post also provides link to an upstream advisory, which has not been published yet. Fixes are not yet available in upstream CVS repository.
http://www.openssl.org/news/secadv_20120419.txt
Discussion:
Created mingw32-openssl tracking bugs for this issue
Affects: fedora-all [bug 814203]
---
Bugzilla
CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
bugzilla·2012-04-19·CVSS 7.5
CVE-2012-2110 [HIGH] CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
CVE-2012-2110 mingw32-openssl: asn1_d2i_read_bio integer errors leading to buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org
arXiv
CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection
arxiv_fulltext·2024-02-29
CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection
: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection
Hao Wang^1, Zeyu Gao^1, Chao Zhang^1, Mingyang Sun^2, Yuchen Zhou^3, Han Qiu^1, Xi Xiao^4
Hao Wang, Zeyu Gao, Chao Zhang, Mingyang Sun, Yuchen Zhou, Han Qiu, Xi Xiao
^1Tsinghua University, Beijing, China
^2University of Electronic Science and Technology of China, Chengdu, China
^3Beijing University of Technology, Beijing, China
^4Tsinghua University, Shenzhen, China
hao-wang20,[email protected],chaoz,[email protected]
[email protected],[email protected],[email protected]
Wang, et al.
## Abstract
Binary code similarity detection (BCSD) is a fundamental technique for various application.
Many BCSD solutions have been proposed recently, which mostly are embed
http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.htmlhttp://cvs.openssl.org/chngview?cn=22431http://cvs.openssl.org/chngview?cn=22434http://cvs.openssl.org/chngview?cn=22439http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.htmlhttp://marc.info/?l=bugtraq&m=133728068926468&w=2http://marc.info/?l=bugtraq&m=133951357207000&w=2http://marc.info/?l=bugtraq&m=134039053214295&w=2http://osvdb.org/81223http://rhn.redhat.com/errata/RHSA-2012-0518.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0522.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1306.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1307.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1308.htmlhttp://secunia.com/advisories/48847http://secunia.com/advisories/48895http://secunia.com/advisories/48899http://secunia.com/advisories/48942http://secunia.com/advisories/48999http://secunia.com/advisories/57353http://support.apple.com/kb/HT5784http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578http://www.debian.org/security/2012/dsa-2454http://www.exploit-db.com/exploits/18756http://www.mandriva.com/security/advisories?name=MDVSA-2012:060http://www.openssl.org/news/secadv_20120419.txthttp://www.securityfocus.com/bid/53158http://www.securitytracker.com/id?1026957http://www.ubuntu.com/usn/USN-1424-1https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862https://kb.juniper.net/KB27376http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.htmlhttp://cvs.openssl.org/chngview?cn=22431http://cvs.openssl.org/chngview?cn=22434http://cvs.openssl.org/chngview?cn=22439http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.htmlhttp://marc.info/?l=bugtraq&m=133728068926468&w=2http://marc.info/?l=bugtraq&m=133951357207000&w=2http://marc.info/?l=bugtraq&m=134039053214295&w=2http://osvdb.org/81223http://rhn.redhat.com/errata/RHSA-2012-0518.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0522.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1306.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1307.htmlhttp://rhn.redhat.com/errata/RHSA-2012-1308.htmlhttp://secunia.com/advisories/48847http://secunia.com/advisories/48895http://secunia.com/advisories/48899http://secunia.com/advisories/48942http://secunia.com/advisories/48999http://secunia.com/advisories/57353http://support.apple.com/kb/HT5784http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578http://www.debian.org/security/2012/dsa-2454http://www.exploit-db.com/exploits/18756http://www.mandriva.com/security/advisories?name=MDVSA-2012:060http://www.openssl.org/news/secadv_20120419.txthttp://www.securityfocus.com/bid/53158http://www.securitytracker.com/id?1026957http://www.ubuntu.com/usn/USN-1424-1https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862https://kb.juniper.net/KB27376
2012-04-19
Published