CVE-2021-20230 | High | 7.5 | 2021-02-23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options… |
CVE-2015-3644 | | | 2015-05-14 | Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allo… |
CVE-2014-0016 | | | 2014-03-24 | stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequen… |
CVE-2013-1762 | | | 2013-03-08 | stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows r… |
CVE-2011-2940 | | | 2011-08-25 | stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. |
CVE-2008-2420 | | | 2008-05-23 | The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended acc… |
CVE-2008-2400 | | | 2008-05-22 | Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors. |
CVE-2003-0740 | | | 2003-10-20 | Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server. |
CVE-2002-1563 | | | 2003-05-12 | stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the c… |
CVE-2003-0147 | | | 2003-03-31 | OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing di… |
CVE-2002-0002 | | | 2002-01-31 | Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbit… |
CVE-2001-0060 | | | 2001-02-12 | Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username. |