| CVE |
Vendors |
Products |
Updated |
CVSS |
| CVE-2013-0169 |
3 Openssl, Oracle, Polarssl |
3 Polarssl, Openjdk, Openssl |
2019-10-09 |
2.6 |
| The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC... |
| CVE-2014-9744 |
3 Novell, Polarssl, Opensuse |
3 Polarssl, Opensuse, Opensuse |
2018-10-30 |
7.8 |
| Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions. |
| CVE-2015-1182 |
3 Novell, Polarssl, Opensuse |
3 Polarssl, Opensuse, Opensuse |
2018-10-30 |
7.5 |
| The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service... |
| CVE-2014-8628 |
1 Polarssl |
1 Polarssl |
2017-11-04 |
7.8 |
| Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to... |
| CVE-2015-5291 |
2 Arm, Polarssl |
2 Mbed Tls, Polarssl |
2017-07-01 |
6.8 |
| Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a... |
| CVE-2015-8036 |
2 Arm, Polarssl |
2 Mbed Tls, Polarssl |
2016-12-06 |
6.8 |
| Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to... |
| CVE-2014-4911 |
2 Debian, Polarssl |
2 Debian Linux, Polarssl |
2015-12-04 |
5.0 |
| The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon... |
| CVE-2014-8627 |
1 Polarssl |
1 Polarssl |
2014-11-25 |
5.0 |
| PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors. |
| CVE-2013-5915 |
1 Polarssl |
1 Polarssl |
2013-10-31 |
4.3 |
| The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys. |
| CVE-2013-4623 |
1 Polarssl |
1 Polarssl |
2013-10-31 |
4.3 |
| The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and... |
| CVE-2013-5914 |
1 Polarssl |
1 Polarssl |
2013-10-28 |
6.8 |
| Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet. |
| CVE-2011-1923 |
1 Polarssl |
1 Polarssl |
2013-10-24 |
4.0 |
| The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a... |
| CVE-2013-1621 |
1 Polarssl |
1 Polarssl |
2013-03-08 |
4.3 |
| Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different... |
