Page 2 of 12 results (0.005 seconds)

CVSS: 5.0EPSS: 0%CPEs: 24EXPL: 0

CVE-2014-4911

https://notcve.org/view.php?id=CVE-2014-4911

The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit. La función ssl_decrypt_buf en library/ssl_tls.c en PolarSSL anterior a 1.2.11 y 1.3.x anterior a 1.3.8 permite a atacantes remotos causar una denegación de servicio (caída) a través de vectores relacionados con los suites de cifrado GCM, tal y como fue demostrado al utilizar el juego de herramientas Codenomicon Defensics. • http://secunia.com/advisories/60215 http://www.debian.org/security/2014/dsa-2981 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-02 • CWE-310: Cryptographic Issues •

CVSS: 6.8EPSS: 6%CPEs: 11EXPL: 0

CVE-2013-5914

https://notcve.org/view.php?id=CVE-2013-5914

Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet. Buffer overflow en la funcón ssl_read_record en ssl_tls.c de PolarSSL anterior a la versión 1.1.8, cuando se utiliza TLS 1.1, podría permitir a atacantes remotos ejecutar código arbitrario a través de un paquete largo. • http://www.debian.org/security/2013/dsa-2782 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 7.4EPSS: 2%CPEs: 5EXPL: 0

CVE-2012-2130

https://notcve.org/view.php?id=CVE-2012-2130

A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys. Se presenta una vulnerabilidad de Omisión de Seguridad en PolarSSL versiones 0.99pre4 hasta 1.1.1, debido a un error de cifrado débil cuando se generan valores Diffie-Hellman y claves RSA. • http://security.gentoo.org/glsa/glsa-201310-10.xml http://www.securityfocus.com/bid/53610 https://bugs.gentoo.org/show_bug.cgi?id=CVE-2012-2130 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2130 https://exchange.xforce.ibmcloud.com/vulnerabilities/75726 https://security-tracker.debian.org/tracker/CVE-2012-2130 • CWE-326: Inadequate Encryption Strength •

CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 0

CVE-2013-5915

https://notcve.org/view.php?id=CVE-2013-5915

The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys. La implementación RSA-CRT- en PolarSSL anterior a la versión 1.2.9 no realiza adecuadamente la multiplicación Montgomery, lo que podría permitir a atacantes llevar a cabo un ataque timing side-channel y conseguir las llaves privadas RSA. • http://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html http://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html http://osvdb.org/98049 http://secunia.com/advisories/55084 http://www.debian.org/security/2013/dsa-2782 http://www.securityfocus.com/bid/62771 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05 • CWE-310: Cryptographic Issues •

CVSS: 4.3EPSS: 4%CPEs: 17EXPL: 1

CVE-2013-4623

https://notcve.org/view.php?id=CVE-2013-4623

The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate. La función x509parse_crt en x509.h de PolarSSL 1.1.x (anteriores a 1.1.7) y 1.2.x (anteriores a 1.2.8) no procesa apropiadamente los mensajes de certificado durante un handshake SSL/TLS, lo que permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU) a través de un mensaje de certificado que contiene un certificado codificado en PEM. • http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html http://www.debian.org/security/2013/dsa-2782 http://www.securityfocus.com/bid/61764 https://bugzilla.redhat.com/show_bug.cgi?id=997767 https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859 https://polarssl.org/tech-updates/security-ad • CWE-20: Improper Input Validation •