TI-2011-03940 CVE-2011-4574 · GHSA-69cr-qg65-xgm7
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.
Priority MEDIUM 44
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.
polarssl
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
polarssl records in CISA KEVNo polarssl vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records
TI-2013-00104 CVE-2013-0169 · GHSA-pg96-42c4-p633
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL…
Priority LOW 39
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the proces…
TI-2015-01069 CVE-2015-1182 · GHSA-8g33-q77c-23f6
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12…
Priority LOW 38
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to ca…
TI-2014-07923 CVE-2014-9744 · GHSA-99v5-5368-pxv4
Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service…
Priority LOW 38
Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages.
TI-2014-07087 CVE-2014-8628 · GHSA-pq2v-pvrw-m6q9
Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to…
Priority LOW 37
Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates.
TI-2012-01903 CVE-2012-2130 · GHSA-75jp-83j7-2672
A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak…
Priority LOW 37
A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys.
TI-2015-04447 CVE-2015-5291 · GHSA-hhcq-g9mx-qpfg
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly…
Priority LOW 36
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly ex…
TI-2013-05049 CVE-2013-5914 · GHSA-vpwv-hwrv-72hw
Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8…
Priority LOW 36
Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet.
TI-2015-06681 CVE-2015-8036 · GHSA-h6fm-cj44-vv3x
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and…
Priority LOW 35
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long…
TI-2014-07086 CVE-2014-8627 · GHSA-9jjq-g2xm-68mw
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows…
Priority LOW 27
PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors.
TI-2014-04043 CVE-2014-4911 · GHSA-5w2p-5ww5-p9p9
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x…
Priority LOW 27
The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated…
TI-2013-05050 CVE-2013-5915 · GHSA-ff9h-pchm-fq33
The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery…
Priority LOW 24
The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.
TI-2013-04060 CVE-2013-4623 · GHSA-hfr2-452h-93q6
The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before…
Priority LOW 24
The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of ser…
TI-2013-01428 CVE-2013-1621 · GHSA-pvmj-2j9v-f5w6
Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers…
Priority LOW 24
Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS sessio…
TI-2011-01695 CVE-2011-1923 · GHSA-rwm6-hmj6-r6h5
The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does…
Priority LOW 21
The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by mo…