DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:1361412562310868964", "type": "openvas", "bulletinFamily": "scanner", "title": "Fedora Update for polarssl FEDORA-2015-0991", "description": "The remote host is missing an update for the ", "published": "2015-01-31T00:00:00", "modified": "2019-03-15T00:00:00", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868964", "reporter": "Copyright (C) 2015 Greenbone Networks GmbH", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html", "2015-0991"], "cvelist": ["CVE-2015-1182", "CVE-2014-8628", "CVE-2013-5915", "CVE-2014-4911"], "lastseen": "2019-05-29T18:36:09", "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "archlinux", "idList": ["ASA-201411-4", "ASA-201501-13"]}, {"type": "cve", "idList": ["CVE-2013-5915", "CVE-2014-4911", "CVE-2014-8628", "CVE-2014-9744", "CVE-2015-1182"]}, {"type": "debian", "idList": ["DEBIAN:DLA-129-1:D0542", "DEBIAN:DLA-144-1:50BA1", "DEBIAN:DLA-36-1:45718", "DEBIAN:DLA-36-1:970BC", "DEBIAN:DSA-2782-1:1D605", "DEBIAN:DSA-2981-1:B676B", "DEBIAN:DSA-2981-1:DB405", "DEBIAN:DSA-3116-1:DEFBB", "DEBIAN:DSA-3136-1:5CEF5", "DEBIAN:DSA-3136-1:91437"]}, {"type": "fedora", "idList": ["FEDORA:2F768259EA", "FEDORA:326682260B", "FEDORA:3E86221F4B", "FEDORA:5F614206D5", "FEDORA:6174860CA52F", "FEDORA:64D1021D50", "FEDORA:859746110265", "FEDORA:8CCCD25999", "FEDORA:C01F021E98", "FEDORA:CAF452178D", "FEDORA:DFDDE212B7", "FEDORA:E2E51611800E", "FEDORA:ED9DB60D00A1"]}, {"type": "freebsd", "idList": ["A5856EBA-A015-11E4-A680-1C6F65C3C4FF", "CCEFAC3E-2AED-11E3-AF10-000C29789CB5"]}, {"type": "gentoo", "idList": ["GLSA-201310-10", "GLSA-201801-15"]}, {"type": "nessus", "idList": ["DEBIAN_DLA-129.NASL", "DEBIAN_DLA-144.NASL", "DEBIAN_DLA-36.NASL", "DEBIAN_DSA-2782.NASL", "DEBIAN_DSA-2981.NASL", "DEBIAN_DSA-3116.NASL", "DEBIAN_DSA-3136.NASL", "FEDORA_2013-18216.NASL", "FEDORA_2013-18228.NASL", "FEDORA_2013-18251.NASL", "FEDORA_2014-14898.NASL", "FEDORA_2014-14912.NASL", "FEDORA_2014-7261.NASL", "FEDORA_2014-7263.NASL", "FEDORA_2014-8310.NASL", "FEDORA_2014-8316.NASL", "FEDORA_2015-0991.NASL", "FEDORA_2015-1045.NASL", "FREEBSD_PKG_A5856EBAA01511E4A6801C6F65C3C4FF.NASL", "FREEBSD_PKG_CCEFAC3E2AED11E3AF10000C29789CB5.NASL", "GENTOO_GLSA-201310-10.NASL", "GENTOO_GLSA-201801-15.NASL", "OPENSUSE-2014-689.NASL", "OPENSUSE-2015-88.NASL", "POLARSSL_CVE-2015-1182.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310121048", "OPENVAS:1361412562310702981", "OPENVAS:1361412562310703116", "OPENVAS:1361412562310703136", "OPENVAS:1361412562310866977", "OPENVAS:1361412562310866980", "OPENVAS:1361412562310867902", "OPENVAS:1361412562310867910", "OPENVAS:1361412562310868013", "OPENVAS:1361412562310868042", "OPENVAS:1361412562310868511", "OPENVAS:1361412562310868515", "OPENVAS:1361412562310868968", "OPENVAS:1361412562310892782", "OPENVAS:702981", "OPENVAS:703116", "OPENVAS:703136", "OPENVAS:866977", "OPENVAS:866980", "OPENVAS:892782"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:29976", "SECURITYVULNS:DOC:30941", "SECURITYVULNS:DOC:31581", "SECURITYVULNS:VULN:13381", "SECURITYVULNS:VULN:13880", "SECURITYVULNS:VULN:14188"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2013-5915", "UB:CVE-2014-4911", "UB:CVE-2014-8628", "UB:CVE-2015-1182"]}]}, "score": {"value": 6.7, "vector": "NONE"}, "backreferences": {"references": [{"type": "archlinux", "idList": ["ASA-201501-13"]}, {"type": "cve", "idList": ["CVE-2013-5915"]}, {"type": "debian", "idList": ["DEBIAN:DLA-36-1:970BC", "DEBIAN:DSA-3116-1:DEFBB"]}, {"type": "fedora", "idList": ["FEDORA:3E86221F4B"]}, {"type": "freebsd", "idList": ["CCEFAC3E-2AED-11E3-AF10-000C29789CB5"]}, {"type": "gentoo", "idList": ["GLSA-201801-15"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-201801-15.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310868515"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13880"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2014-4911"]}]}, "exploitation": null, "vulnersScore": 6.7}, "pluginID": "1361412562310868964", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2015-0991\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868964\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-31 06:01:55 +0100 (Sat, 31 Jan 2015)\");\n script_cve_id(\"CVE-2015-1182\", \"CVE-2014-8628\", \"CVE-2014-4911\", \"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Fedora Update for polarssl FEDORA-2015-0991\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-0991\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.12~3.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "naslFamily": "Fedora Local Security Checks", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647589307, "score": 0}}

{"fedora": [{"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2015-01-30T04:31:47", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: polarssl-1.2.12-3.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911", "CVE-2014-8628", "CVE-2015-1182"], "modified": "2015-01-30T04:31:47", "id": "FEDORA:6174860CA52F", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JDPRTWLRG2IUUGS4HTMDUIAY63BTXLFR/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-11-22T12:43:01", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: polarssl-1.2.12-1.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911", "CVE-2014-8627", "CVE-2014-8628"], "modified": "2014-11-22T12:43:01", "id": "FEDORA:E2E51611800E", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/S63HEBSCPZQXQ73MAG5JERTDZRRASWNN/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-11-22T12:45:21", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: polarssl-1.2.12-1.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911", "CVE-2014-8627", "CVE-2014-8628"], "modified": "2014-11-22T12:45:21", "id": "FEDORA:859746110265", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FB5WH3RYFT52DR3JNEBW7JBEC2CLOUXH/", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-07-22T03:29:26", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: polarssl-1.2.11-1.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911"], "modified": "2014-07-22T03:29:26", "id": "FEDORA:8CCCD25999", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UJFQ2HAMEAXXF3XO3K4ESBU6BB27CJYQ/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-07-22T03:29:38", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: polarssl-1.2.11-1.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911"], "modified": "2014-07-22T03:29:38", "id": "FEDORA:2F768259EA", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UDMKK4ZPJBWOR2OVB4BM6SAD5YTUQMXO/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2013-10-10T14:46:18", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: polarssl-1.2.9-1.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-10T14:46:18", "id": "FEDORA:326682260B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7HZLLTNYHZTYS262HRIVSF4TVN3QSGNA/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2013-10-14T06:58:59", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: polarssl-1.2.9-1.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-14T06:58:59", "id": "FEDORA:CAF452178D", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RVO3TRQK2LGIUIJPPQOWNL2TXL4JLW3P/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2013-10-14T17:09:04", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: polarssl-1.2.9-1.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-14T17:09:04", "id": "FEDORA:DFDDE212B7", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RVO3TRQK2LGIUIJPPQOWNL2TXL4JLW3P/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-06-19T22:55:06", "type": "fedora", "title": "[SECURITY] Fedora 20 Update: polarssl-1.2.10-2.fc20", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2014-06-19T22:55:06", "id": "FEDORA:64D1021D50", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GQSQTKE33EADPHFPFS4XG6EDMR74IIC2/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2014-06-19T22:57:44", "type": "fedora", "title": "[SECURITY] Fedora 19 Update: polarssl-1.2.10-2.fc19", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2014-06-19T22:57:44", "id": "FEDORA:3E86221F4B", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MIE4ALQBIIKT6JOJ37ASWNJG7LEXP5TD/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2015-01-30T04:41:21", "type": "fedora", "title": "[SECURITY] Fedora 21 Update: polarssl-1.3.9-3.fc21", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-30T04:41:21", "id": "FEDORA:ED9DB60D00A1", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BRTVR3AHZCOM3DKHWLKRDLGLYKSDUJ2E/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2013-10-14T07:00:42", "type": "fedora", "title": "[SECURITY] Fedora 18 Update: polarssl-1.2.9-1.fc18", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0169", "CVE-2013-1621", "CVE-2013-5915"], "modified": "2013-10-14T07:00:42", "id": "FEDORA:5F614206D5", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5GLSQNGFNRAVXJR7JAEJ3CCX4XHIDNTK/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:52", "description": "PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible. ", "cvss3": {}, "published": "2013-10-14T17:17:04", "type": "fedora", "title": "[SECURITY] Fedora 18 Update: polarssl-1.2.9-1.fc18", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-0169", "CVE-2013-1621", "CVE-2013-5915"], "modified": "2013-10-14T17:17:04", "id": "FEDORA:C01F021E98", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5GLSQNGFNRAVXJR7JAEJ3CCX4XHIDNTK/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:37:38", "description": "Check the version of polarssl", "cvss3": {}, "published": "2014-11-23T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-14898", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8628", "CVE-2013-5915", "CVE-2014-8627", "CVE-2014-4911"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868515", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868515", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-14898\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868515\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-11-23 06:45:17 +0100 (Sun, 23 Nov 2014)\");\n script_cve_id(\"CVE-2014-8628\", \"CVE-2014-4911\", \"CVE-2013-5915\", \"CVE-2014-8627\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-14898\");\n script_tag(name:\"summary\", value:\"Check the version of polarssl\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-14898\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/144832.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.12~1.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:37:25", "description": "Check the version of polarssl", "cvss3": {}, "published": "2014-11-23T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-14912", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8628", "CVE-2013-5915", "CVE-2014-8627", "CVE-2014-4911"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868511", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868511", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-14912\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868511\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-11-23 06:45:02 +0100 (Sun, 23 Nov 2014)\");\n script_cve_id(\"CVE-2014-8628\", \"CVE-2014-4911\", \"CVE-2013-5915\", \"CVE-2014-8627\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-14912\");\n script_tag(name:\"summary\", value:\"Check the version of polarssl\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-14912\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/144811.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.12~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2019-05-29T18:37:34", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-07-28T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-8316", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868042", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868042", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-8316\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868042\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-07-28 16:28:13 +0530 (Mon, 28 Jul 2014)\");\n script_cve_id(\"CVE-2014-4911\", \"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-8316\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-8316\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135644.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.11~1.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:37:13", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-07-28T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-8310", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2014-4911"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868013", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868013", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-8310\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868013\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-07-28 16:13:57 +0530 (Mon, 28 Jul 2014)\");\n script_cve_id(\"CVE-2014-4911\", \"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-8310\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-8310\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135646.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.11~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:37:14", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-06-23T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-7261", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867902", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867902", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-7261\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867902\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-06-23 10:37:35 +0530 (Mon, 23 Jun 2014)\");\n script_cve_id(\"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-7261\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-7261\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134559.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.10~2.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:37:35", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2014-06-23T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2014-7263", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310867910", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867910", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2014-7263\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867910\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-06-23 13:29:59 +0530 (Mon, 23 Jun 2014)\");\n script_cve_id(\"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2014-7263\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-7263\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134551.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.10~2.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:38:29", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2013-10-15T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2013-18228", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310866980", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310866980", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2013-18228\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.866980\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-15 13:00:02 +0530 (Tue, 15 Oct 2013)\");\n script_cve_id(\"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2013-18228\");\n\n\n script_tag(name:\"affected\", value:\"polarssl on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2013-18228\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.9~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2018-01-18T11:09:40", "description": "Check for the Version of polarssl", "cvss3": {}, "published": "2013-10-15T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2013-18228", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2018-01-17T00:00:00", "id": "OPENVAS:866980", "href": "http://plugins.openvas.org/nasl.php?oid=866980", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2013-18228\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(866980);\n script_version(\"$Revision: 8448 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-17 17:18:06 +0100 (Wed, 17 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-15 13:00:02 +0530 (Tue, 15 Oct 2013)\");\n script_cve_id(\"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2013-18228\");\n\n tag_insight = \"PolarSSL is a light-weight open source cryptographic and SSL/TLS\nlibrary written in C. PolarSSL makes it easy for developers to include\ncryptographic and SSL/TLS capabilities in their (embedded)\napplications with as little hassle as possible.\n\";\n\n tag_affected = \"polarssl on Fedora 19\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2013-18228\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html\");\n script_tag(name: \"summary\" , value: \"Check for the Version of polarssl\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.9~1.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-03-20T16:43:36", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8628"], "description": "It was discovered that a memory leak\nin parsing X.509 certificates may result in denial of service.", "modified": "2018-03-19T00:00:00", "published": "2014-12-30T00:00:00", "id": "OPENVAS:703116", "href": "http://plugins.openvas.org/nasl.php?oid=703116", "type": "openvas", "title": "Debian Security Advisory DSA 3116-1 (polarssl - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3116.nasl 9136 2018-03-19 13:08:02Z cfischer $\n# Auto-generated from advisory DSA 3116-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703116);\n script_version(\"$Revision: 9136 $\");\n script_cve_id(\"CVE-2014-8628\");\n script_name(\"Debian Security Advisory DSA 3116-1 (polarssl - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2018-03-19 14:08:02 +0100 (Mon, 19 Mar 2018) $\");\n script_tag(name: \"creation_date\", value: \"2014-12-30 00:00:00 +0100 (Tue, 30 Dec 2014)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-3116.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"polarssl on Debian Linux\");\n script_tag(name: \"insight\", value: \"PolarSSL is a fork of the abandoned\nproject XySSL. It is a lean crypto library providing SSL and TLS support in your\nprograms.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthis problem has been fixed in version 1.2.9-1~deb7u4.\n\nFor the upcoming stable distribution (jessie), this problem has been\nfixed in version 1.3.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.9-1.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name: \"summary\", value: \"It was discovered that a memory leak\nin parsing X.509 certificates may result in denial of service.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u4\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:37:31", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-8628"], "description": "It was discovered that a memory leak\nin parsing X.509 certificates may result in denial of service.", "modified": "2019-03-18T00:00:00", "published": "2014-12-30T00:00:00", "id": "OPENVAS:1361412562310703116", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703116", "type": "openvas", "title": "Debian Security Advisory DSA 3116-1 (polarssl - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3116.nasl 14277 2019-03-18 14:45:38Z cfischer $\n# Auto-generated from advisory DSA 3116-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703116\");\n script_version(\"$Revision: 14277 $\");\n script_cve_id(\"CVE-2014-8628\");\n script_name(\"Debian Security Advisory DSA 3116-1 (polarssl - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:45:38 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-12-30 00:00:00 +0100 (Tue, 30 Dec 2014)\");\n script_tag(name:\"cvss_base\", value:\"7.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2014/dsa-3116.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"polarssl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy),\nthis problem has been fixed in version 1.2.9-1~deb7u4.\n\nFor the upcoming stable distribution (jessie), this problem has been\nfixed in version 1.3.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.9-1.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name:\"summary\", value:\"It was discovered that a memory leak\nin parsing X.509 certificates may result in denial of service.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u4\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2017-07-31T10:48:47", "description": "A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.", "cvss3": {}, "published": "2014-07-18T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2981-1 (polarssl - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2017-07-14T00:00:00", "id": "OPENVAS:702981", "href": "http://plugins.openvas.org/nasl.php?oid=702981", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2981.nasl 6724 2017-07-14 09:57:17Z teissa $\n# Auto-generated from advisory DSA 2981-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ntag_affected = \"polarssl on Debian Linux\";\ntag_insight = \"PolarSSL is a fork of the abandoned project XySSL. It is a lean crypto\nlibrary providing SSL and TLS support in your programs.\";\ntag_solution = \"For the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 1.3.7-2.1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.7-2.1.\n\nWe recommend that you upgrade your polarssl packages.\";\ntag_summary = \"A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(702981);\n script_version(\"$Revision: 6724 $\");\n script_cve_id(\"CVE-2014-4911\");\n script_name(\"Debian Security Advisory DSA 2981-1 (polarssl - security update)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-14 11:57:17 +0200 (Fri, 14 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2014-07-18 00:00:00 +0200 (Fri, 18 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2014/dsa-2981.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.2\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7.3\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:37:32", "description": "A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.", "cvss3": {}, "published": "2014-07-18T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2981-1 (polarssl - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2019-03-19T00:00:00", "id": "OPENVAS:1361412562310702981", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310702981", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2981.nasl 14302 2019-03-19 08:28:48Z cfischer $\n# Auto-generated from advisory DSA 2981-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.702981\");\n script_version(\"$Revision: 14302 $\");\n script_cve_id(\"CVE-2014-4911\");\n script_name(\"Debian Security Advisory DSA 2981-1 (polarssl - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 09:28:48 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-07-18 00:00:00 +0200 (Fri, 18 Jul 2014)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2014/dsa-2981.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2014 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"polarssl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 1.3.7-2.1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.7-2.1.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name:\"summary\", value:\"A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u3\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2017-07-24T12:53:29", "description": "A vulnerability was discovered in\nPolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could\nexploit this flaw using specially crafted certificates to mount a denial of\nservice against an application linked against the library (application crash), or\npotentially, to execute arbitrary code.", "cvss3": {}, "published": "2015-01-24T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3136-1 (polarssl - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:703136", "href": "http://plugins.openvas.org/nasl.php?oid=703136", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3136.nasl 6609 2017-07-07 12:05:59Z cfischer $\n# Auto-generated from advisory DSA 3136-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703136);\n script_version(\"$Revision: 6609 $\");\n script_cve_id(\"CVE-2015-1182\");\n script_name(\"Debian Security Advisory DSA 3136-1 (polarssl - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:05:59 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2015-01-24 00:00:00 +0100 (Sat, 24 Jan 2015)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2015/dsa-3136.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"polarssl on Debian Linux\");\n script_tag(name: \"insight\", value: \"PolarSSL is a fork of the abandoned\nproject XySSL. It is a lean crypto library providing SSL and TLS support in your\nprograms.\");\n script_tag(name: \"solution\", value: \"For the stable distribution (wheezy),\nthis problem has been fixed in version 1.2.9-1~deb7u5.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name: \"summary\", value: \"A vulnerability was discovered in\nPolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could\nexploit this flaw using specially crafted certificates to mount a denial of\nservice against an application linked against the library (application crash), or\npotentially, to execute arbitrary code.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u5\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u5\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u5\", rls_regex:\"DEB7.[0-9]\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:36:15", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2015-01-31T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2015-1045", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310868968", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868968", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2015-1045\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2015 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868968\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-31 06:02:19 +0100 (Sat, 31 Jan 2015)\");\n script_cve_id(\"CVE-2015-1182\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for polarssl FEDORA-2015-1045\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"polarssl on Fedora 21\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2015-1045\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148903.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2015 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC21\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC21\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.3.9~3.fc21\", rls:\"FC21\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:36:22", "description": "A vulnerability was discovered in\nPolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could\nexploit this flaw using specially crafted certificates to mount a denial of\nservice against an application linked against the library (application crash), or\npotentially, to execute arbitrary code.", "cvss3": {}, "published": "2015-01-24T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 3136-1 (polarssl - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310703136", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703136", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3136.nasl 14278 2019-03-18 14:47:26Z cfischer $\n# Auto-generated from advisory DSA 3136-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703136\");\n script_version(\"$Revision: 14278 $\");\n script_cve_id(\"CVE-2015-1182\");\n script_name(\"Debian Security Advisory DSA 3136-1 (polarssl - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:47:26 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2015-01-24 00:00:00 +0100 (Sat, 24 Jan 2015)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2015/dsa-3136.html\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"polarssl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (wheezy),\nthis problem has been fixed in version 1.2.9-1~deb7u5.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name:\"summary\", value:\"A vulnerability was discovered in\nPolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could\nexploit this flaw using specially crafted certificates to mount a denial of\nservice against an application linked against the library (application crash), or\npotentially, to execute arbitrary code.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u5\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u5\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u5\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2018-01-24T11:09:20", "description": "Check for the Version of polarssl", "cvss3": {}, "published": "2013-10-15T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2013-18251", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0169", "CVE-2013-5915", "CVE-2013-1621"], "modified": "2018-01-24T00:00:00", "id": "OPENVAS:866977", "href": "http://plugins.openvas.org/nasl.php?oid=866977", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2013-18251\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_id(866977);\n script_version(\"$Revision: 8509 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-24 07:57:46 +0100 (Wed, 24 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-15 12:59:50 +0530 (Tue, 15 Oct 2013)\");\n script_cve_id(\"CVE-2013-5915\", \"CVE-2013-0169\", \"CVE-2013-1621\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2013-18251\");\n\n tag_insight = \"PolarSSL is a light-weight open source cryptographic and SSL/TLS\nlibrary written in C. PolarSSL makes it easy for developers to include\ncryptographic and SSL/TLS capabilities in their (embedded)\napplications with as little hassle as possible.\n\";\n\n tag_affected = \"polarssl on Fedora 18\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2013-18251\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html\");\n script_tag(name: \"summary\" , value: \"Check for the Version of polarssl\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.9~1.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-07-24T12:51:31", "description": "Multiple security issues have been discovered in PolarSSL, a lightweight\ncrypto and SSL/TLS library:\n\nCVE-2013-4623 \nJack Lloyd discovered a denial of service vulnerability in the\nparsing of PEM-encoded certificates.\n\nCVE-2013-5914 \nPaul Brodeur and TrustInSoft discovered a buffer overflow in the\nssl_read_record() function, allowing the potential execution of\narbitrary code.\n\nCVE-2013-5915 \nCyril Arnaud and Pierre-Alain Fouque discovered timing attacks against\nthe RSA implementation.", "cvss3": {}, "published": "2013-10-20T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2782-1 (polarssl - several vulnerabilities)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2013-5914", "CVE-2013-4623"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:892782", "href": "http://plugins.openvas.org/nasl.php?oid=892782", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2782.nasl 6611 2017-07-07 12:07:20Z cfischer $\n# Auto-generated from advisory DSA 2782-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\n\ntag_affected = \"polarssl on Debian Linux\";\ntag_insight = \"PolarSSL is a fork of the abandoned project XySSL. It is a lean crypto\nlibrary providing SSL and TLS support in your programs.\";\ntag_solution = \"For the oldstable distribution (squeeze), these problems will be fixed in\nversion 1.2.9-1~deb6u1 soon (due to a technical limitation the updates\ncannot be released synchronously).\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 1.2.9-1~deb7u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.1-1.\n\nWe recommend that you upgrade your polarssl packages.\";\ntag_summary = \"Multiple security issues have been discovered in PolarSSL, a lightweight\ncrypto and SSL/TLS library:\n\nCVE-2013-4623 \nJack Lloyd discovered a denial of service vulnerability in the\nparsing of PEM-encoded certificates.\n\nCVE-2013-5914 \nPaul Brodeur and TrustInSoft discovered a buffer overflow in the\nssl_read_record() function, allowing the potential execution of\narbitrary code.\n\nCVE-2013-5915 \nCyril Arnaud and Pierre-Alain Fouque discovered timing attacks against\nthe RSA implementation.\";\ntag_vuldetect = \"This check tests the installed software version using the apt package manager.\";\n\nif(description)\n{\n script_id(892782);\n script_version(\"$Revision: 6611 $\");\n script_cve_id(\"CVE-2013-5914\", \"CVE-2013-4623\", \"CVE-2013-5915\");\n script_name(\"Debian Security Advisory DSA 2782-1 (polarssl - several vulnerabilities)\");\n script_tag(name: \"last_modification\", value:\"$Date: 2017-07-07 14:07:20 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value:\"2013-10-20 00:00:00 +0200 (Sun, 20 Oct 2013)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2013/dsa-2782.html\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: tag_affected);\n script_tag(name: \"insight\", value: tag_insight);\n# script_tag(name: \"impact\", value: tag_impact);\n script_tag(name: \"solution\", value: tag_solution);\n script_tag(name: \"summary\", value: tag_summary);\n script_tag(name: \"vuldetect\", value: tag_vuldetect);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:15", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2013-10-15T00:00:00", "type": "openvas", "title": "Fedora Update for polarssl FEDORA-2013-18251", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0169", "CVE-2013-5915", "CVE-2013-1621"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310866977", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310866977", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for polarssl FEDORA-2013-18251\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.866977\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-15 12:59:50 +0530 (Tue, 15 Oct 2013)\");\n script_cve_id(\"CVE-2013-5915\", \"CVE-2013-0169\", \"CVE-2013-1621\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for polarssl FEDORA-2013-18251\");\n\n\n script_tag(name:\"affected\", value:\"polarssl on Fedora 18\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2013-18251\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'polarssl'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC18\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC18\")\n{\n\n if ((res = isrpmvuln(pkg:\"polarssl\", rpm:\"polarssl~1.2.9~1.fc18\", rls:\"FC18\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:38:25", "description": "Multiple security issues have been discovered in PolarSSL, a lightweight\ncrypto and SSL/TLS library:\n\nCVE-2013-4623\nJack Lloyd discovered a denial of service vulnerability in the\nparsing of PEM-encoded certificates.\n\nCVE-2013-5914\nPaul Brodeur and TrustInSoft discovered a buffer overflow in the\nssl_read_record() function, allowing the potential execution of\narbitrary code.\n\nCVE-2013-5915\nCyril Arnaud and Pierre-Alain Fouque discovered timing attacks against\nthe RSA implementation.", "cvss3": {}, "published": "2013-10-20T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2782-1 (polarssl - several vulnerabilities)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2013-5914", "CVE-2013-4623"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:1361412562310892782", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310892782", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2782.nasl 14276 2019-03-18 14:43:56Z cfischer $\n# Auto-generated from advisory DSA 2782-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.892782\");\n script_version(\"$Revision: 14276 $\");\n script_cve_id(\"CVE-2013-5914\", \"CVE-2013-4623\", \"CVE-2013-5915\");\n script_name(\"Debian Security Advisory DSA 2782-1 (polarssl - several vulnerabilities)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:43:56 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2013-10-20 00:00:00 +0200 (Sun, 20 Oct 2013)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2013/dsa-2782.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2013 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n script_tag(name:\"affected\", value:\"polarssl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the oldstable distribution (squeeze), these problems will be fixed in\nversion 1.2.9-1~deb6u1 soon (due to a technical limitation the updates\ncannot be released synchronously).\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 1.2.9-1~deb7u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.1-1.\n\nWe recommend that you upgrade your polarssl packages.\");\n script_tag(name:\"summary\", value:\"Multiple security issues have been discovered in PolarSSL, a lightweight\ncrypto and SSL/TLS library:\n\nCVE-2013-4623\nJack Lloyd discovered a denial of service vulnerability in the\nparsing of PEM-encoded certificates.\n\nCVE-2013-5914\nPaul Brodeur and TrustInSoft discovered a buffer overflow in the\nssl_read_record() function, allowing the potential execution of\narbitrary code.\n\nCVE-2013-5915\nCyril Arnaud and Pierre-Alain Fouque discovered timing attacks against\nthe RSA implementation.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libpolarssl-dev\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl-runtime\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libpolarssl0\", ver:\"1.2.9-1~deb7u1\", rls:\"DEB7\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-12-30T13:59:34", "description": "Gentoo Linux Local Security Checks GLSA 201310-10", "cvss3": {}, "published": "2015-09-29T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201310-10", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-0169", "CVE-2013-5915", "CVE-2012-2130", "CVE-2011-1923", "CVE-2013-1621", "CVE-2013-4623"], "modified": "2019-12-28T00:00:00", "id": "OPENVAS:1361412562310121048", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121048", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121048\");\n script_version(\"2019-12-28T10:21:15+0000\");\n script_tag(name:\"creation_date\", value:\"2015-09-29 11:26:07 +0300 (Tue, 29 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"2019-12-28 10:21:15 +0000 (Sat, 28 Dec 2019)\");\n script_name(\"Gentoo Security Advisory GLSA 201310-10\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201310-10\");\n script_cve_id(\"CVE-2011-1923\", \"CVE-2012-2130\", \"CVE-2013-0169\", \"CVE-2013-1621\", \"CVE-2013-4623\", \"CVE-2013-5915\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201310-10\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"net-libs/polarssl\", unaffected: make_list(\"ge 1.3.0\"), vulnerable: make_list(\"lt 1.3.0\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "mageia": [{"lastseen": "2022-04-18T11:19:34", "description": "Updated hiawatha package fixes security vulnerabilities: The hiawatha package included a bundled copy of PolarSSL 1.3.2, which was vulnerable to several security issues that had already been fixed in the system polarssl package. These issues were CVE-2014-4911, CVE-2014-8627, CVE-2014-8628, and CVE-2015-1182, which were fixed in MGASA-2014-0315, MGASA-2014-0481, and MGASA-2015-0055. The polarssl package has been adjusted so that hiawatha can use it, and hiawatha has been rebuilt to use the updated system polarssl, fixing these issues. \n", "cvss3": {}, "published": "2015-05-05T13:36:50", "type": "mageia", "title": "Updated polarssl & hiawatha packages fix security vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911", "CVE-2014-8627", "CVE-2014-8628", "CVE-2015-1182"], "modified": "2015-05-05T13:36:50", "id": "MGASA-2015-0185", "href": "https://advisories.mageia.org/MGASA-2015-0185.html", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Updated polarssl packages fix security vulnerability: The researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well (CVE-2013-5915). Also, the pdns package has been updated to work with the updated polarssl. \n", "cvss3": {}, "published": "2013-11-30T21:15:26", "type": "mageia", "title": "Updated polarssl, pdns & ragel packages fix CVE-2013-5915\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-11-30T21:15:26", "id": "MGASA-2013-0353", "href": "https://advisories.mageia.org/MGASA-2013-0353.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-04-18T11:19:34", "description": "A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute the denial of service attack against its clients (CVE-2014-4911). The pdns package has been rebuilt against the updated polarssl library. \n", "cvss3": {}, "published": "2014-08-05T20:08:48", "type": "mageia", "title": "Updated polarssl packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-08-05T20:08:48", "id": "MGASA-2014-0315", "href": "https://advisories.mageia.org/MGASA-2014-0315.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-04-18T11:19:34", "description": "A regression in PolarSSL 1.3.8 resulted in servers negotiating a weaker signature algorithm than available. This has been fixed in PolarSSL 1.3.9 (CVE-2014-8627). Two remotely-triggerable memory leaks were found by the Codenomicon Defensics tool and fixed in PolarSSL 1.3.9 (CVE-2014-8628). \n", "cvss3": {}, "published": "2014-11-22T10:54:50", "type": "mageia", "title": "Updated polarssl package fix security vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8627", "CVE-2014-8628"], "modified": "2014-11-22T10:54:50", "id": "MGASA-2014-0481", "href": "https://advisories.mageia.org/MGASA-2014-0481.html", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2022-04-18T11:19:34", "description": "Updated polarssl packages fix security vulnerability: A vulnerability was discovered in PolarSSL in its certificate parser. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code (CVE-2015-1182). \n", "cvss3": {}, "published": "2015-02-09T21:44:14", "type": "mageia", "title": "Updated polarssl packages fix CVE-2015-1182\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-02-09T21:44:14", "id": "MGASA-2015-0055", "href": "https://advisories.mageia.org/MGASA-2015-0055.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-08-19T12:52:31", "description": "Bugfix release fixing CVE-2013-5915, https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2013-10-11T00:00:00", "type": "nessus", "title": "Fedora 20 : polarssl-1.2.9-1.fc20 (2013-18216)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2013-18216.NASL", "href": "https://www.tenable.com/plugins/nessus/70377", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-18216.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70377);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-5915\");\n script_bugtraq_id(62771);\n script_xref(name:\"FEDORA\", value:\"2013-18216\");\n\n script_name(english:\"Fedora 20 : polarssl-1.2.9-1.fc20 (2013-18216)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Bugfix release fixing CVE-2013-5915,\nhttps://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-October/118758.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1c97778e\"\n );\n # https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://tls.mbed.org/tech-updates/releases/polarssl-1.2.9-released\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"polarssl-1.2.9-1.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:52:27", "description": "PolarSSL Project reports :\n\nThe researchers Cyril Arnaud and Pierre-Alain Fouque investigated the PolarSSL RSA implementation and discovered a bias in the implementation of the Montgomery multiplication that we used. For which they then show that it can be used to mount an attack on the RSA key. Although their test attack is done on a local system, there seems to be enough indication that this can properly be performed from a remote system as well.\n\nAll versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third party can send arbitrary handshake messages to your server.\n\nIf correctly executed, this attack reveals the entire private RSA key after a large number of attack messages (> 600.000 on a local machine) are sent to show the timing differences.", "cvss3": {"score": null, "vector": null}, "published": "2013-10-02T00:00:00", "type": "nessus", "title": "FreeBSD : polarssl -- Timing attack against protected RSA-CRT implementation (ccefac3e-2aed-11e3-af10-000c29789cb5)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:polarssl", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_CCEFAC3E2AED11E3AF10000C29789CB5.NASL", "href": "https://www.tenable.com/plugins/nessus/70264", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70264);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2013-5915\");\n\n script_name(english:\"FreeBSD : polarssl -- Timing attack against protected RSA-CRT implementation (ccefac3e-2aed-11e3-af10-000c29789cb5)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"PolarSSL Project reports :\n\nThe researchers Cyril Arnaud and Pierre-Alain Fouque investigated the\nPolarSSL RSA implementation and discovered a bias in the\nimplementation of the Montgomery multiplication that we used. For\nwhich they then show that it can be used to mount an attack on the RSA\nkey. Although their test attack is done on a local system, there seems\nto be enough indication that this can properly be performed from a\nremote system as well.\n\nAll versions prior to PolarSSL 1.2.9 and 1.3.0 are affected if a third\nparty can send arbitrary handshake messages to your server.\n\nIf correctly executed, this attack reveals the entire private RSA key\nafter a large number of attack messages (> 600.000 on a local machine)\nare sent to show the timing differences.\"\n );\n # https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-05\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?37fce654\"\n );\n # https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://tls.mbed.org/tech-updates/releases/polarssl-1.2.9-released\"\n );\n # https://vuxml.freebsd.org/freebsd/ccefac3e-2aed-11e3-af10-000c29789cb5.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f3f3dc6b\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2013/10/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"polarssl<1.2.9\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:49:19", "description": "- Update to 1.2.10\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-06-20T00:00:00", "type": "nessus", "title": "Fedora 19 : polarssl-1.2.10-2.fc19 (2014-7261)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-7261.NASL", "href": "https://www.tenable.com/plugins/nessus/76152", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-7261.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76152);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-5915\");\n script_bugtraq_id(62771);\n script_xref(name:\"FEDORA\", value:\"2014-7261\");\n\n script_name(english:\"Fedora 19 : polarssl-1.2.10-2.fc19 (2014-7261)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.10\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1015946\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134559.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7b76df5b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/06/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"polarssl-1.2.10-2.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:52:42", "description": "Bugfix release fixing CVE-2013-5915, https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2013-10-15T00:00:00", "type": "nessus", "title": "Fedora 19 : polarssl-1.2.9-1.fc19 (2013-18228)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2013-18228.NASL", "href": "https://www.tenable.com/plugins/nessus/70419", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-18228.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70419);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-5915\");\n script_bugtraq_id(62771);\n script_xref(name:\"FEDORA\", value:\"2013-18228\");\n\n script_name(english:\"Fedora 19 : polarssl-1.2.9-1.fc19 (2013-18228)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Bugfix release fixing CVE-2013-5915,\nhttps://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119014.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?04f83002\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119084.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b3bf2cf5\"\n );\n # https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://tls.mbed.org/tech-updates/releases/polarssl-1.2.9-released\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"polarssl-1.2.9-1.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:49:19", "description": "- Update to 1.2.10\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-06-20T00:00:00", "type": "nessus", "title": "Fedora 20 : polarssl-1.2.10-2.fc20 (2014-7263)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-7263.NASL", "href": "https://www.tenable.com/plugins/nessus/76153", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-7263.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76153);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-5915\");\n script_bugtraq_id(62771);\n script_xref(name:\"FEDORA\", value:\"2014-7263\");\n\n script_name(english:\"Fedora 20 : polarssl-1.2.10-2.fc20 (2014-7263)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.10\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1015946\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-June/134551.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?3052953c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/06/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"polarssl-1.2.10-2.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:52:32", "description": "Bugfix release fixing CVE-2013-5915, https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2013-10-15T00:00:00", "type": "nessus", "title": "Fedora 18 : polarssl-1.2.9-1.fc18 (2013-18251)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:18"], "id": "FEDORA_2013-18251.NASL", "href": "https://www.tenable.com/plugins/nessus/70420", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2013-18251.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70420);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-5915\");\n script_bugtraq_id(62771);\n script_xref(name:\"FEDORA\", value:\"2013-18251\");\n\n script_name(english:\"Fedora 18 : polarssl-1.2.9-1.fc18 (2013-18251)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Bugfix release fixing CVE-2013-5915,\nhttps://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119018.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?89d693a5\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119139.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?40093699\"\n );\n # https://polarssl.org/tech-updates/releases/polarssl-1.2.9-released\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://tls.mbed.org/tech-updates/releases/polarssl-1.2.9-released\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:18\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^18([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 18.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC18\", reference:\"polarssl-1.2.9-1.fc18\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-08-19T12:47:27", "description": "It was discovered that a memory leak in parsing X.509 certificates may result in denial of service.", "cvss3": {"score": null, "vector": null}, "published": "2015-01-02T00:00:00", "type": "nessus", "title": "Debian DSA-3116-1 : polarssl - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8628"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:polarssl", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3116.NASL", "href": "https://www.tenable.com/plugins/nessus/80307", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3116. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80307);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-8628\");\n script_bugtraq_id(70905);\n script_xref(name:\"DSA\", value:\"3116\");\n\n script_name(english:\"Debian DSA-3116-1 : polarssl - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that a memory leak in parsing X.509 certificates may\nresult in denial of service.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/polarssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2014/dsa-3116\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the polarssl packages.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u4.\n\nFor the upcoming stable distribution (jessie), this problem has been\nfixed in version 1.3.9-1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/12/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb7u4\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb7u4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-08-19T12:46:31", "description": "It was discovered that a memory leak in parsing X.509 certificates may result in denial of service.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-03-26T00:00:00", "type": "nessus", "title": "Debian DLA-129-1 : polarssl security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8628"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libpolarssl-dev", "p-cpe:/a:debian:debian_linux:libpolarssl-runtime", "p-cpe:/a:debian:debian_linux:libpolarssl0", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-129.NASL", "href": "https://www.tenable.com/plugins/nessus/82112", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-129-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(82112);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-8628\");\n script_bugtraq_id(70905);\n\n script_name(english:\"Debian DLA-129-1 : polarssl security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that a memory leak in parsing X.509 certificates may\nresult in denial of service.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2015/01/msg00001.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/polarssl\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb6u3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb6u3\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb6u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-08-19T12:46:43", "description": "Denial of Service against GCM enabled servers (and clients).\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-03-26T00:00:00", "type": "nessus", "title": "Debian DLA-36-1 : polarssl security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libpolarssl-dev", "p-cpe:/a:debian:debian_linux:libpolarssl-runtime", "p-cpe:/a:debian:debian_linux:libpolarssl0", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-36.NASL", "href": "https://www.tenable.com/plugins/nessus/82184", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-36-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(82184);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-4911\");\n script_bugtraq_id(68748);\n\n script_name(english:\"Debian DLA-36-1 : polarssl security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Denial of Service against GCM enabled servers (and clients).\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2014/08/msg00010.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/polarssl\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/08/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb6u2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb6u2\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb6u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:49:15", "description": "- Update to 1.2.11\n\n - CVE-2014-4911 (rhbz#1118929, rhbz#1118930)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-07-22T00:00:00", "type": "nessus", "title": "Fedora 19 : polarssl-1.2.11-1.fc19 (2014-8310)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-8310.NASL", "href": "https://www.tenable.com/plugins/nessus/76628", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-8310.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76628);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-4911\");\n script_bugtraq_id(68748);\n script_xref(name:\"FEDORA\", value:\"2014-8310\");\n\n script_name(english:\"Fedora 19 : polarssl-1.2.11-1.fc19 (2014-8310)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.11\n\n - CVE-2014-4911 (rhbz#1118929, rhbz#1118930)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1118929\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135646.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1a7e877c\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"polarssl-1.2.11-1.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:49:11", "description": "- Update to 1.2.11\n\n - CVE-2014-4911 (rhbz#1118929, rhbz#1118930)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-07-22T00:00:00", "type": "nessus", "title": "Fedora 20 : polarssl-1.2.11-1.fc20 (2014-8316)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-8316.NASL", "href": "https://www.tenable.com/plugins/nessus/76629", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-8316.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76629);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-4911\");\n script_bugtraq_id(68748);\n script_xref(name:\"FEDORA\", value:\"2014-8316\");\n\n script_name(english:\"Fedora 20 : polarssl-1.2.11-1.fc20 (2014-8316)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.11\n\n - CVE-2014-4911 (rhbz#1118929, rhbz#1118930)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1118929\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135644.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fd34eadf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"polarssl-1.2.11-1.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:49:04", "description": "A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library, which can be exploited by a remote unauthenticated attacker to mount a denial of service against PolarSSL servers that offer GCM ciphersuites. Potentially clients are affected too if a malicious server decides to execute the denial of service attack against its clients.", "cvss3": {"score": null, "vector": null}, "published": "2014-07-20T00:00:00", "type": "nessus", "title": "Debian DSA-2981-1 : polarssl - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-4911"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:polarssl", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2981.NASL", "href": "https://www.tenable.com/plugins/nessus/76599", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2981. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(76599);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-4911\");\n script_xref(name:\"DSA\", value:\"2981\");\n\n script_name(english:\"Debian DSA-2981-1 : polarssl - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker\nto mount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious\nserver decides to execute the denial of service attack against its\nclients.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754655\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/polarssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2014/dsa-2981\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the polarssl packages.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u3.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb7u3\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb7u3\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-08-19T12:47:41", "description": "- Update to 1.2.12\n\n - CVE-2014-8628 (#1159845)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-11-24T00:00:00", "type": "nessus", "title": "Fedora 20 : polarssl-1.2.12-1.fc20 (2014-14898)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8627", "CVE-2014-8628"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2014-14898.NASL", "href": "https://www.tenable.com/plugins/nessus/79394", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-14898.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79394);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-8627\", \"CVE-2014-8628\");\n script_bugtraq_id(70902, 70905);\n script_xref(name:\"FEDORA\", value:\"2014-14898\");\n\n script_name(english:\"Fedora 20 : polarssl-1.2.12-1.fc20 (2014-14898)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.12\n\n - CVE-2014-8628 (#1159845)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1159845\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-November/144832.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7ba04bc1\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"polarssl-1.2.12-1.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-08-19T12:48:02", "description": "polarssl was updated to version 1.3.9 to fix two security issues.\n\nThese security issues were fixed :\n\n - Lowest common hash was selected from signature_algorithms extension in TLS 1.2 (CVE-2014-8627).\n\n - Remotely-triggerable memory leak when parsing some X.509 certificates (CVE-2014-8628).", "cvss3": {"score": null, "vector": null}, "published": "2014-11-20T00:00:00", "type": "nessus", "title": "openSUSE Security Update : polarssl (openSUSE-SU-2014:1457-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8627", "CVE-2014-8628"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libpolarssl7", "p-cpe:/a:novell:opensuse:libpolarssl7-debuginfo", "p-cpe:/a:novell:opensuse:polarssl-devel", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2014-689.NASL", "href": "https://www.tenable.com/plugins/nessus/79348", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2014-689.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79348);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2014-8627\", \"CVE-2014-8628\");\n\n script_name(english:\"openSUSE Security Update : polarssl (openSUSE-SU-2014:1457-1)\");\n script_summary(english:\"Check for the openSUSE-2014-689 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"polarssl was updated to version 1.3.9 to fix two security issues.\n\nThese security issues were fixed :\n\n - Lowest common hash was selected from\n signature_algorithms extension in TLS 1.2\n (CVE-2014-8627).\n\n - Remotely-triggerable memory leak when parsing some X.509\n certificates (CVE-2014-8628).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=903671\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=903672\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libpolarssl7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libpolarssl7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:polarssl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libpolarssl7-1.3.9-4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libpolarssl7-debuginfo-1.3.9-4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"polarssl-devel-1.3.9-4.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libpolarssl7 / libpolarssl7-debuginfo / polarssl-devel\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-08-19T12:47:57", "description": "- Update to 1.2.12\n\n - CVE-2014-8628 (#1159845)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2014-11-24T00:00:00", "type": "nessus", "title": "Fedora 19 : polarssl-1.2.12-1.fc19 (2014-14912)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2014-8627", "CVE-2014-8628"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:19"], "id": "FEDORA_2014-14912.NASL", "href": "https://www.tenable.com/plugins/nessus/79395", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-14912.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(79395);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2014-8627\", \"CVE-2014-8628\");\n script_bugtraq_id(70902, 70905);\n script_xref(name:\"FEDORA\", value:\"2014-14912\");\n\n script_name(english:\"Fedora 19 : polarssl-1.2.12-1.fc19 (2014-14912)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Update to 1.2.12\n\n - CVE-2014-8628 (#1159845)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1159845\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-November/144811.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c963ba20\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/11/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/11/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"polarssl-1.2.12-1.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2022-04-12T15:43:46", "description": "PolarSSL contains a flaw when parsing ASN.1 sequences from X.509 certificates due to freeing an uninitialized pointer by the function 'asn1_get_sequence_of' within file 'asn1parse.c'. An unauthenticated, remote attacker, using a specially crafted certificate, can exploit this flaw to cause a denial of service or execute arbitrary code.\n\nThis plugin sends client certificates with an X.509 Extended Key Usage extension that contains a malformed key purpose OID. PolarSSL allocates a 'asn1_sequence' structure to store the OID. For this plugin to work, the following conditions must be met :\n\n - (1) The 'next' field of the allocated 'asn_sequence' structure for the malformed key purpose OID must be non-zero.\n\n - (2) The SSL server requests a client certificate.", "cvss3": {"score": 10, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}, "published": "2015-01-28T00:00:00", "type": "nessus", "title": "PolarSSL 'asn1_get_sequence_of' Function Uninitialized Pointer RCE", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:polarssl:polarssl"], "id": "POLARSSL_CVE-2015-1182.NASL", "href": "https://www.tenable.com/plugins/nessus/81047", "sourceData": "#TRUSTED 739d5c8b6980b4702b6688841b7749579492abf4a1a1e6387efb68d9c082c072f140412c1bc15ffa3f86b3cc823b7b3bc5c7750332e7c2131d314e2824ce453e1d9b7fbabb481bc90e849a74ad5be56f28b77c71e0931f31c93ef93e0ff12da95d2f5527cbf2b4f5b3ddf8a86817a2025b7e90cdd1745f5f8af3f09a65c337489ba8736b8aab47293887aebdb336824e930ea4a29684e63624450278209637719fa52f94ef99f15e8804c1dd23cf5382f90df85ecceabc60a56d6e46f00c9b697963ca0351f5e7f8d34ec843dca6878494d1923b3ae76eee81e31bcb4381eabb0e427901b1e31905a771adf4d0ab1b8dc0e1281c0b60711a13288986ab353caa2d373f910997ae11b99667d0ecb46ff689cc110882f7c15cf3f9f2a9505218880861b01e76e422717df98b77a572f18a335781c654b116b99cdb3410d7918602cf7c8226bc7583cd6bb0c44eb57f3e693677745a421b70c12d53471063ebefcb4c089a599fe6e396b244aa2473ebc975eb9081c21b1d682ce5dcdcbf37e47f9d40ab2572b5b20f491d188cb4eb1d96e7a7271addf63268178c49bbad44fa5d07c877ea8983c5d9df668fa864cd30910900bd53d86a86a696675a4a46ec39f925ab35de2baee53f00d3aec2b0fe83c878e683d9e23486a4d7288a80333dd76f1756a773f2f80a1571b3d57817ab13e67d8c6e7a7ef83c668300db6a3ed61d6e7a\n#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81047);\n script_version(\"1.21\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2015-1182\");\n\n script_name(english:\"PolarSSL 'asn1_get_sequence_of' Function Uninitialized Pointer RCE\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SSL server is vulnerable to remote code execution.\");\n script_set_attribute(attribute:\"description\", value:\n\"PolarSSL contains a flaw when parsing ASN.1 sequences from X.509\ncertificates due to freeing an uninitialized pointer by the function\n'asn1_get_sequence_of' within file 'asn1parse.c'. An unauthenticated,\nremote attacker, using a specially crafted certificate, can exploit\nthis flaw to cause a denial of service or execute arbitrary code.\n\nThis plugin sends client certificates with an X.509 Extended Key Usage\nextension that contains a malformed key purpose OID. PolarSSL\nallocates a 'asn1_sequence' structure to store the OID. For this\nplugin to work, the following conditions must be met :\n\n - (1) The 'next' field of the allocated 'asn_sequence'\n structure for the malformed key purpose OID must be\n non-zero.\n\n - (2) The SSL server requests a client certificate.\");\n # https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?8e6caee6\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.certifiedsecure.com/polarssl-advisory/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Follow the instructions in the vendor advisory.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2015-1182\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/01/19\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:polarssl:polarssl\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_DESTRUCTIVE_ATTACK);\n script_family(english:\"General\");\n\n script_copyright(english:\"This script is Copyright (C) 2015-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssl_supported_ciphers.nasl\");\n script_require_keys(\"SSL/Supported\");\n script_timeout(1800);\n\n exit(0);\n}\n\ninclude(\"byte_func.inc\");\ninclude(\"ftp_func.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"der_funcs.inc\");\ninclude(\"ldap_func.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"nntp_func.inc\");\ninclude(\"smtp_func.inc\");\ninclude(\"ssl_funcs.inc\");\ninclude(\"telnet2_func.inc\");\n\n##\n#\n# Create an X509 certificate extension\n#\n# @param oid extentions OID\n# @param crit whether the extension is to be critical\n# @param value extension value (DER-encoded)\n# @return DER-encoded extension or NULL on error\n# @remark\n#\n# Extension ::= SEQUENCE {\n# extnID OBJECT IDENTIFIER,\n# critical BOOLEAN DEFAULT FALSE,\n# extnValue OCTET STRING\n# -- contains the DER encoding of an ASN.1 value\n# -- corresponding to the extension type identified\n# -- by extnID\n# }\n##\nfunction x509_ext(oid, crit, value)\n{\n local_var ext;\n\n oid = der_encode_oid(oid:oid);\n\n crit = der_encode(tag:0x01, data:raw_string(crit));\n\n value = der_encode_octet_string (string: value);\n\n if(isnull(oid) || isnull(crit) || isnull(value))\n return NULL;\n\n ext = oid + crit + value;\n\n ext = der_encode (tag:0x30, data:ext);\n\n return ext;\n}\n\n##\n#\n# Create a x509 certificate with an Extended Key Usage extension\n#\n# @param kp_cnt number of key purpose OIDs in the Extented Key Usage extension\n# @param bad whether to append a malformed key purpose OID to the end of the\n# Extended Key Usage exension\n# @return an x509 certificate\n# @remark\n# - The output certificate type is RSA\n# - Most fields are hardcoded\n# - The certificate need not to be verifiable\n#\n##\nfunction my_cert(kp_cnt,bad)\n{\n local_var cert, issuer, serial, sig, sig_alg_id, version;\n local_var pubkey_info, subject, tbs, validity;\n local_var alg, exts, ext_eku, eku, i, kp, pubkey;\n\n # version [0] EXPLICIT Version DEFAULT v1,\n # Version ::= INTEGER { v1(0), v2(1), v3(2) }\n version = der_encode(tag:2, data:raw_string(2));\n version = der_encode(tag:0xa0, data: version);\n\n # serialNumber CertificateSerialNumber,\n # CertificateSerialNumber ::= INTEGER\n serial = raw_string(0x00, 0xba, 0xdc, 0xbb, 0xc3, 0xdb, 0x90, 0xdf);\n serial = der_encode(tag:2, data: serial);\n\n # signatureAlgorithm AlgorithmIdentifier,\n # AlgorithmIdentifier ::= SEQUENCE {\n # algorithm OBJECT IDENTIFIER,\n # parameters ANY DEFINED BY algorithm OPTIONAL }\n #\n #\n # PolarSSL (1.3.9) supports the following SignatureAlgorithmIdentifier (oid.c):\n # md2WithRSAEncryption\n # md4WithRSAEncryption\n # md5WithRSAEncryption\n # sha1WithRSAEncryption\n # sha224WithRSAEncryption\n # sha256WithRSAEncryption\n # sha384WithRSAEncryption\n # sha512WithRSAEncryption\n # ecdsa-with-SHA1\n # ecdsa-with-SHA224\n # ecdsa-with-SHA256\n # ecdsa-with-SHA384\n # ecdsa-with-SHA512\n # RSASSA-PSS\n #\n # use sha1WithRSAEncryption to cover more PolarSSL versions as\n # older versions may not support ecdsa-based SignatureAlgorithmIdentifier\n sig_alg_id = der_encode_oid(oid:\"1.2.840.113549.1.1.5\");\n sig_alg_id = der_encode(tag:0x30, data: sig_alg_id);\n\n # issuer Name,\n #\n # Name ::= CHOICE { -- only one possibility for now --\n # rdnSequence RDNSequence }\n #\n # RDNSequence ::= SEQUENCE OF RelativeDistinguishedName\n #\n # RelativeDistinguishedName ::=\n # SET SIZE (1..MAX) OF AttributeTypeAndValue\n #\n # AttributeTypeAndValue ::= SEQUENCE {\n # type AttributeType,\n # value AttributeValue }\n #\n # AttributeType ::= OBJECT IDENTIFIER\n #\n # AttributeValue ::= ANY -- DEFINED BY AttributeType\n #\n # DirectoryString ::= CHOICE {\n # teletexString TeletexString (SIZE (1..MAX)),\n # printableString PrintableString (SIZE (1..MAX)),\n # universalString UniversalString (SIZE (1..MAX)),\n # utf8String UTF8String (SIZE (1..MAX)),\n # bmpString BMPString (SIZE (1..MAX)) }\n issuer = raw_string(\n 0x30, 0x4f,\n 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,\n 0x06, 0x13, 0x02, 0x55, 0x53,\n\n 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,\n 0x08, 0x0c, 0x02, 0x4d, 0x44,\n\n 0x31, 0x15, 0x30, 0x13, 0x06, 0x03, 0x55, 0x04,\n 0x07, 0x0c, 0x0c, 0x44, 0x65, 0x66, 0x61, 0x75,\n 0x6c, 0x74, 0x20, 0x43, 0x69, 0x74, 0x79,\n\n 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x04,\n 0x0a, 0x0c, 0x13, 0x44, 0x65, 0x66, 0x61, 0x75,\n 0x6c, 0x74, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61,\n 0x6e, 0x79, 0x20, 0x4c, 0x74, 0x64\n );\n\n # Validity ::= SEQUENCE {\n # notBefore Time,\n # notAfter Time }\n #\n # Time ::= CHOICE {\n # utcTime UTCTime,\n # generalTime GeneralizedTime }\n validity = raw_string(\n 0x30, 0x1e,\n 0x17, 0x0d, 0x31, 0x35, 0x30, 0x31, 0x32, 0x30,\n 0x32, 0x33, 0x33, 0x33, 0x32, 0x34, 0x5a, 0x17,\n 0x0d, 0x32, 0x35, 0x30, 0x31, 0x31, 0x37, 0x32,\n 0x33, 0x33, 0x33, 0x32, 0x34, 0x5a\n );\n\n # subject Name\n subject = raw_string(\n 0x30, 0x4f,\n 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,\n 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0b, 0x30,\n 0x09, 0x06, 0x03, 0x55, 0x04, 0x08, 0x0c, 0x02,\n 0x4d, 0x44, 0x31, 0x15, 0x30, 0x13, 0x06, 0x03,\n 0x55, 0x04, 0x07, 0x0c, 0x0c, 0x44, 0x65, 0x66,\n 0x61, 0x75, 0x6c, 0x74, 0x20, 0x43, 0x69, 0x74,\n 0x79, 0x31, 0x1c, 0x30, 0x1a, 0x06, 0x03, 0x55,\n 0x04, 0x0a, 0x0c, 0x13, 0x44, 0x65, 0x66, 0x61,\n 0x75, 0x6c, 0x74, 0x20, 0x43, 0x6f, 0x6d, 0x70,\n 0x61, 0x6e, 0x79, 0x20, 0x4c, 0x74, 0x64\n );\n\n # SubjectPublicKeyInfo ::= SEQUENCE {\n # algorithm AlgorithmIdentifier,\n # subjectPublicKey BIT STRING }\n #\n # AlgorithmIdentifier ::= SEQUENCE {\n # algorithm OBJECT IDENTIFIER,\n # parameters ANY DEFINED BY algorithm OPTIONAL }\n\n # rsaEncryption\n alg = der_encode_oid(oid:\"1.2.840.113549.1.1.1\");\n alg = der_encode(tag:0x30, data:alg);\n\n # RFC 3447\n #\n # RSAPublicKey ::= SEQUENCE {\n # modulus INTEGER, -- n\n # publicExponent INTEGER -- e\n # }\n #\n # NOTE: n and e must to be a odd number\n pubkey = der_encode(tag:2,data:crap(data:'A',length:64)) +\n der_encode(tag:2,data:'\\x01\\x00\\x01') ;\n pubkey = der_encode(tag:0x30, data:pubkey);\n pubkey = '\\x00' + pubkey; # no padding bits\n pubkey = der_encode(tag:3, data:pubkey);\n\n pubkey_info = der_encode(tag:0x30, data: alg + pubkey);\n\n\n # ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId\n #\n # KeyPurposeId ::= OBJECT IDENTIFIER\n #\n if (! kp_cnt) kp_cnt = 1; # mininum one valid key purpose OID\n\n kp = NULL;\n for(i = 0; i < kp_cnt; i++)\n {\n # timeStamping\n kp += der_encode_oid(oid:\"1.3.6.1.5.5.7.3.8\");\n }\n\n if(bad)\n {\n # Malformed timeStamping key purpose OID\n kp += raw_string(\n #0x06, 0x08, # Correct length for the OID\n 0x06, 0x7f, # Invalid length for the OID\n 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08\n );\n }\n\n eku = der_encode(tag:0x30, data: kp);\n ext_eku = x509_ext(oid:\"2.5.29.37\", crit:1, value: eku);\n\n #Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension\n exts = der_encode(tag:0x30, data: ext_eku);\n\n #extensions [3] EXPLICIT Extensions OPTIONAL\n exts = der_encode(tag:0xa3, data: exts);\n\n tbs = version +\n serial +\n sig_alg_id +\n issuer +\n validity +\n subject +\n pubkey_info +\n # skip optional fields:\n # issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,\n # subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,\n exts;\n\n tbs = der_encode(tag:0x30, data:tbs);\n\n\n # signatureValue BIT STRING\n sig = crap(data:'S', length:64);\n sig = '\\x00' + sig; # no padding bits\n sig = der_encode(tag:3, data:sig);\n\n\n cert = tbs +\n sig_alg_id +\n sig;\n\n cert = der_encode(tag:0x30, data:cert);\n\n return cert;\n}\n\nfunction attack(port, kp_cnt)\n{\n local_var ciphersuites, cspeclen, exts, exts_len, version;\n local_var alert, chello, clt_cert_req, hellodone, shello;\n local_var cert, cipher, data, i, list, msg, rec, soc;\n\n # Create a socket for SSL handshake\n soc = open_sock_ssl(port);\n if ( ! soc ) exit(1, \"Failed to open an SSL socket on port \"+port+\".\");\n\n\n # Use TLS version 1.2, allow downgrade\n version = TLS_12;\n\n # Use detected cipher suites.\n list = get_kb_list(\"SSL/Ciphers/\" + port);\n if(list) list = make_list(list);\n else list = keys(ciphers);\n\n ciphersuites = NULL;\n exts = NULL;\n foreach cipher (list)\n {\n if(strlen(ciphers[cipher]) == 2)\n {\n ciphersuites += ciphers[cipher];\n\n if(tls_is_ec_cipher(cipher) && isnull(exts))\n {\n # We need to include EC extensions because it seems PolarSSL server\n # will abort the handshake if a EC-based cipher suite is negotiated\n # but a EC extension is not offered by the client.\n exts = tls_ext_ec() + tls_ext_ec_pt_fmt();\n }\n # Do not specify more than 128 cipher suites, as some older\n # PolarSSL versions don't support it.\n if(strlen(ciphersuites) >= 254) break;\n }\n }\n\n # Send ClientHello\n msg =\n mkword(version) + # Client version\n dec2hex(num:unixtime()) + # Challenge, epoch portion\n rand_str(length:28) + # Challenge, random portion\n ssl_vldata_put(data:'', len:1) + # Session ID\n ssl_vldata_put(data:ciphersuites, len:2) + # Cipher suites\n ssl_vldata_put(data:'\\x00', len:1); # Compression spec\n\n if(exts) msg += ssl_vldata_put(data:exts, len:2); # Extensions\n\n msg = ssl_mk_handshake_msg(data:msg, type:SSL3_HANDSHAKE_TYPE_CLIENT_HELLO);\n chello = ssl_mk_record(type:SSL3_CONTENT_TYPE_HANDSHAKE, data:msg, version:TLS_10);\n send(socket:soc, data: chello);\n\n hellodone = shello = clt_cert_req = NULL;\n i = 0;\n while (! hellodone)\n {\n # Receive a record from the server.\n data = recv_ssl(socket:soc, timeout:30);\n if (isnull(data)) break;\n\n # ServerHello\n if(! shello)\n {\n shello = ssl_find(\n blob:data,\n 'content_type', SSL3_CONTENT_TYPE_HANDSHAKE,\n 'handshake_type', SSL3_HANDSHAKE_TYPE_SERVER_HELLO\n );\n\n if (shello)\n {\n # Check handshake version returned by the server\n # If TLS 1.2 not supported, use a lower version\n if (shello['handshake_version'] != TLS_12)\n {\n\n if (shello['handshake_version'] >= SSL_V3)\n {\n version = shello['handshake_version'];\n }\n else\n {\n close(soc);\n exit(0, 'The service listening on port ' + port + ' does not support SSLv3 or above.' );\n }\n }\n }\n else\n {\n alert = ssl_find(\n blob:data,\n 'content_type', SSL3_CONTENT_TYPE_ALERT\n );\n if(alert)\n {\n close(soc);\n exit(1, 'Alert received from service listening on port '+ port +': level '+ alert['level'] + ', description code ' + alert['description'] + ', Nessus could not procdeed with the vulnerablity check.');\n }\n }\n }\n\n # Client Certificate Request\n if(! clt_cert_req)\n {\n clt_cert_req = ssl_find(\n blob:data,\n 'content_type', SSL3_CONTENT_TYPE_HANDSHAKE,\n 'handshake_type',SSL3_HANDSHAKE_TYPE_CERTIFICATE_REQUEST\n );\n\n }\n\n # Server Hello Done.\n if(! hellodone)\n {\n hellodone = ssl_find(\n blob:data,\n 'content_type', SSL3_CONTENT_TYPE_HANDSHAKE,\n 'handshake_type', SSL3_HANDSHAKE_TYPE_SERVER_HELLO_DONE\n );\n\n if(hellodone) break;\n }\n\n # ServerHelloDone not seen after a higher number of SSL records\n # Something is very wrong\n if(i++ > 16) break;\n }\n\n # Make sure we got a ServerHelloDone\n if(! hellodone)\n {\n close(soc);\n exit(1, 'ServerHelloDone not received from service listening on port '+ port +'.');\n }\n\n # We cannot send a client cert if not asked by the server\n if(! clt_cert_req)\n {\n close(soc);\n exit(1, 'The service listening on port '+ port +' did not ask for a client certificate.');\n }\n\n cert = my_cert(kp_cnt: kp_cnt, bad:TRUE);\n\n if(isnull(cert))\n {\n close(soc);\n exit(1, 'Failed to create a bad certificate to send to SSL server listening on '+ port +'.');\n }\n\n msg = ssl_vldata_put(data:cert, len:3); # cert\n msg = ssl_vldata_put(data: msg, len:3); # cert chain\n msg = ssl_mk_handshake_msg(\n type : SSL3_HANDSHAKE_TYPE_CERTIFICATE,\n data : msg\n );\n rec = ssl_mk_record(type:SSL3_CONTENT_TYPE_HANDSHAKE, data:msg, version:version);\n\n send(socket: soc, data: rec);\n usleep(100);\n close(soc);\n}\n\n#\n# MAIN\n#\n\n# Get an SSL port\nport = get_ssl_ports(fork:TRUE);\nif (isnull(port))\n exit(0, \"The host does not appear to have any SSL-based services.\");\n\n# Attempt to crash remote SSL server\nfor(i = 1; i <= 100; i++)\n{\n attack(port:port, kp_cnt: i);\n\n if(service_is_dead(port:port) == 1)\n {\n extra = 'Crash at attempt ' + i + '.';\n security_hole(port:port, extra: extra);\n exit(0);\n }\n # If service is not dead, cannot tell it's vulnerable\n\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:47:02", "description": "PolarSSL team reports :\n\nDuring the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free().\n\nThis sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate.", "cvss3": {"score": null, "vector": null}, "published": "2015-01-20T00:00:00", "type": "nessus", "title": "FreeBSD : polarssl -- Remote attack using crafted certificates (a5856eba-a015-11e4-a680-1c6f65c3c4ff)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:polarssl", "p-cpe:/a:freebsd:freebsd:polarssl13", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_A5856EBAA01511E4A6801C6F65C3C4FF.NASL", "href": "https://www.tenable.com/plugins/nessus/80840", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80840);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2015-1182\");\n\n script_name(english:\"FreeBSD : polarssl -- Remote attack using crafted certificates (a5856eba-a015-11e4-a680-1c6f65c3c4ff)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"PolarSSL team reports :\n\nDuring the parsing of a ASN.1 sequence, a pointer in the linked list\nof asn1_sequence is not initialized by asn1_get_sequence_of(). In case\nan error occurs during parsing of the list, a situation is created\nwhere the uninitialized pointer is passed to polarssl_free().\n\nThis sequence can be triggered when a PolarSSL entity is parsing a\ncertificate. So practically this means clients when receiving a\ncertificate from the server or servers in case they are actively\nasking for a client certificate.\"\n );\n # https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8e6caee6\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.certifiedsecure.com/polarssl-advisory/\"\n );\n # https://vuxml.freebsd.org/freebsd/a5856eba-a015-11e4-a680-1c6f65c3c4ff.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?635f69ac\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:polarssl13\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2015/01/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"polarssl>=1.2.0<1.2.12_1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"polarssl13>=1.3.0<1.3.9_1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:47:14", "description": "A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code.", "cvss3": {"score": null, "vector": null}, "published": "2015-01-26T00:00:00", "type": "nessus", "title": "Debian DSA-3136-1 : polarssl - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:polarssl", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-3136.NASL", "href": "https://www.tenable.com/plugins/nessus/80971", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3136. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(80971);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-1182\");\n script_xref(name:\"DSA\", value:\"3136\");\n\n script_name(english:\"Debian DSA-3136-1 : polarssl - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability was discovered in PolarSSL, a lightweight crypto and\nSSL/TLS library. A remote attacker could exploit this flaw using\nspecially crafted certificates to mount a denial of service against an\napplication linked against the library (application crash), or\npotentially, to execute arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775776\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/polarssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2015/dsa-3136\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the polarssl packages.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u5.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), this problem will be fixed soon.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb7u5\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb7u5\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb7u5\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:47:12", "description": "- Fix for CVE-2015-1182\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-01-30T00:00:00", "type": "nessus", "title": "Fedora 20 : polarssl-1.2.12-3.fc20 (2015-0991)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:20"], "id": "FEDORA_2015-0991.NASL", "href": "https://www.tenable.com/plugins/nessus/81092", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-0991.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81092);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-1182\");\n script_bugtraq_id(72306);\n script_xref(name:\"FEDORA\", value:\"2015-0991\");\n\n script_name(english:\"Fedora 20 : polarssl-1.2.12-3.fc20 (2015-0991)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fix for CVE-2015-1182\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1184028\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7206f0c4\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"polarssl-1.2.12-3.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:47:15", "description": "- Fix for CVE-2015-1182\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-01-30T00:00:00", "type": "nessus", "title": "Fedora 21 : polarssl-1.3.9-3.fc21 (2015-1045)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:polarssl", "cpe:/o:fedoraproject:fedora:21"], "id": "FEDORA_2015-1045.NASL", "href": "https://www.tenable.com/plugins/nessus/81093", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2015-1045.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81093);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-1182\");\n script_bugtraq_id(72306);\n script_xref(name:\"FEDORA\", value:\"2015-1045\");\n\n script_name(english:\"Fedora 21 : polarssl-1.3.9-3.fc21 (2015-1045)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fix for CVE-2015-1182\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1184028\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148903.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b6893f2a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:21\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/01/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^21([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 21.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC21\", reference:\"polarssl-1.3.9-3.fc21\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"polarssl\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:46:25", "description": "A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code.\n\nNOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-03-26T00:00:00", "type": "nessus", "title": "Debian DLA-144-1 : polarssl security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:libpolarssl-dev", "p-cpe:/a:debian:debian_linux:libpolarssl-runtime", "p-cpe:/a:debian:debian_linux:libpolarssl0", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DLA-144.NASL", "href": "https://www.tenable.com/plugins/nessus/82127", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Debian Security Advisory DLA-144-1. The text\n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(82127);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2015-1182\");\n script_bugtraq_id(72306);\n\n script_name(english:\"Debian DLA-144-1 : polarssl security update\");\n script_summary(english:\"Checks dpkg output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability was discovered in PolarSSL, a lightweight crypto and\nSSL/TLS library. A remote attacker could exploit this flaw using\nspecially crafted certificates to mount a denial of service against an\napplication linked against the library (application crash), or\npotentially, to execute arbitrary code.\n\nNOTE: Tenable Network Security has extracted the preceding description\nblock directly from the DLA security advisory. Tenable has attempted\nto automatically clean and format it as much as possible without\nintroducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.debian.org/debian-lts-announce/2015/01/msg00018.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze-lts/polarssl\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libpolarssl0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb6u4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb6u4\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb6u4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:47:18", "description": "polarssl was updated to fix a remote attack using crafted certificates. (boo#913903, CVE-2015-1182)", "cvss3": {"score": null, "vector": null}, "published": "2015-02-03T00:00:00", "type": "nessus", "title": "openSUSE Security Update : polarssl (openSUSE-SU-2015:0186-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libpolarssl7", "p-cpe:/a:novell:opensuse:libpolarssl7-debuginfo", "p-cpe:/a:novell:opensuse:polarssl-devel", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2015-88.NASL", "href": "https://www.tenable.com/plugins/nessus/81138", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-88.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(81138);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2015-1182\");\n\n script_name(english:\"openSUSE Security Update : polarssl (openSUSE-SU-2015:0186-1)\");\n script_summary(english:\"Check for the openSUSE-2015-88 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"polarssl was updated to fix a remote attack using crafted\ncertificates. (boo#913903, CVE-2015-1182)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=913903\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2015-02/msg00003.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected polarssl packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libpolarssl7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libpolarssl7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:polarssl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/01/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/02/03\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libpolarssl7-1.3.9-8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libpolarssl7-debuginfo-1.3.9-8.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"polarssl-devel-1.3.9-8.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libpolarssl7 / libpolarssl7-debuginfo / polarssl-devel\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:52:37", "description": "Multiple security issues have been discovered in PolarSSL, a lightweight crypto and SSL/TLS library :\n\n - CVE-2013-4623 Jack Lloyd discovered a denial of service vulnerability in the parsing of PEM-encoded certificates.\n\n - CVE-2013-5914 Paul Brodeur and TrustInSoft discovered a buffer overflow in the ssl_read_record() function, allowing the potential execution of arbitrary code.\n\n - CVE-2013-5915 Cyril Arnaud and Pierre-Alain Fouque discovered timing attacks against the RSA implementation.", "cvss3": {"score": null, "vector": null}, "published": "2013-10-22T00:00:00", "type": "nessus", "title": "Debian DSA-2782-1 : polarssl - several vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2013-4623", "CVE-2013-5914", "CVE-2013-5915"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:polarssl", "cpe:/o:debian:debian_linux:6.0", "cpe:/o:debian:debian_linux:7.0"], "id": "DEBIAN_DSA-2782.NASL", "href": "https://www.tenable.com/plugins/nessus/70533", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2782. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70533);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2013-4623\", \"CVE-2013-5914\", \"CVE-2013-5915\");\n script_bugtraq_id(61764, 62771);\n script_xref(name:\"DSA\", value:\"2782\");\n\n script_name(english:\"Debian DSA-2782-1 : polarssl - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security issues have been discovered in PolarSSL, a\nlightweight crypto and SSL/TLS library :\n\n - CVE-2013-4623\n Jack Lloyd discovered a denial of service vulnerability\n in the parsing of PEM-encoded certificates.\n\n - CVE-2013-5914\n Paul Brodeur and TrustInSoft discovered a buffer\n overflow in the ssl_read_record() function, allowing the\n potential execution of arbitrary code.\n\n - CVE-2013-5915\n Cyril Arnaud and Pierre-Alain Fouque discovered timing\n attacks against the RSA implementation.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2013-4623\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2013-5914\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2013-5915\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/polarssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/wheezy/polarssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2013/dsa-2782\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the polarssl packages.\n\nFor the oldstable distribution (squeeze), these problems will be fixed\nin version 1.2.9-1~deb6u1 soon (due to a technical limitation the\nupdates cannot be released synchronously).\n\nFor the stable distribution (wheezy), these problems have been fixed\nin version 1.2.9-1~deb7u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:7.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb6u1\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb6u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-dev\", reference:\"1.2.9-1~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl-runtime\", reference:\"1.2.9-1~deb7u1\")) flag++;\nif (deb_check(release:\"7.0\", prefix:\"libpolarssl0\", reference:\"1.2.9-1~deb7u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-16T13:25:56", "description": "The remote host is affected by the vulnerability described in GLSA-201801-15 (PolarSSL: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker might be able to execute arbitrary code, cause Denial of Service condition or obtain sensitive information.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"score": 5.9, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "published": "2018-01-15T00:00:00", "type": "nessus", "title": "GLSA-201801-15 : PolarSSL: Multiple vulnerabilities (SLOTH)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2015-1182", "CVE-2015-7575"], "modified": "2018-01-15T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:polarssl", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201801-15.NASL", "href": "https://www.tenable.com/plugins/nessus/106039", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201801-15.\n#\n# The advisory text is Copyright (C) 2001-2018 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(106039);\n script_version(\"$Revision: 1.1 $\");\n script_cvs_date(\"$Date: 2018/01/15 15:03:59 $\");\n\n script_cve_id(\"CVE-2015-1182\", \"CVE-2015-7575\");\n script_xref(name:\"GLSA\", value:\"201801-15\");\n\n script_name(english:\"GLSA-201801-15 : PolarSSL: Multiple vulnerabilities (SLOTH)\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201801-15\n(PolarSSL: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in PolarSSL. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker might be able to execute arbitrary code, cause Denial\n of Service condition or obtain sensitive information.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201801-15\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Gentoo has discontinued support for PolarSSL and recommends that users\n unmerge the package:\n # emerge --unmerge 'net-libs/polarssl'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/01/15\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/01/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-libs/polarssl\", unaffected:make_list(), vulnerable:make_list(\"lt 1.3.9-r1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"PolarSSL\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-08-19T12:52:34", "description": "The remote host is affected by the vulnerability described in GLSA-201310-10 (PolarSSL: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker might be able to cause Denial of Service, conduct a man-in-the middle attack, compromise an encrypted communication channel, or obtain sensitive information.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"score": 7.4, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}, "published": "2013-10-18T00:00:00", "type": "nessus", "title": "GLSA-201310-10 : PolarSSL: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-1923", "CVE-2012-2130", "CVE-2013-0169", "CVE-2013-1621", "CVE-2013-4623", "CVE-2013-5915"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:polarssl", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201310-10.NASL", "href": "https://www.tenable.com/plugins/nessus/70486", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201310-10.\n#\n# The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(70486);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-1923\", \"CVE-2012-2130\", \"CVE-2013-0169\", \"CVE-2013-1621\", \"CVE-2013-4623\", \"CVE-2013-5915\");\n script_bugtraq_id(46670, 53610, 57776, 57778, 61764, 62771);\n script_xref(name:\"GLSA\", value:\"201310-10\");\n\n script_name(english:\"GLSA-201310-10 : PolarSSL: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201310-10\n(PolarSSL: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in PolarSSL. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker might be able to cause Denial of Service, conduct a\n man-in-the middle attack, compromise an encrypted communication channel,\n or obtain sensitive information.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201310-10\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All PolarSSL users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-libs/polarssl-1.3.0'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:polarssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/06/20\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/10/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/10/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-libs/polarssl\", unaffected:make_list(\"ge 1.3.0\"), vulnerable:make_list(\"lt 1.3.0\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"PolarSSL\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "ubuntucve": [{"lastseen": "2021-11-22T21:47:18", "description": "The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly\nperform Montgomery multiplication, which might allow remote attackers to\nconduct a timing side-channel attack and retrieve RSA private keys.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725359>\n", "cvss3": {}, "published": "2013-10-04T00:00:00", "type": "ubuntucve", "title": "CVE-2013-5915", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-04T00:00:00", "id": "UB:CVE-2013-5915", "href": "https://ubuntu.com/security/CVE-2013-5915", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-11-22T21:49:01", "description": "Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote\nattackers to cause a denial of service (memory consumption) via a large\nnumber of crafted X.509 certificates. NOTE: this identifier has been SPLIT\nper ADT3 due to different affected versions. See CVE-2014-9744 for the\nClientHello message issue.", "cvss3": {}, "published": "2015-08-24T00:00:00", "type": "ubuntucve", "title": "CVE-2014-8628", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628"], "modified": "2015-08-24T00:00:00", "id": "UB:CVE-2014-8628", "href": "https://ubuntu.com/security/CVE-2014-8628", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-11-22T21:51:26", "description": "The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11\nand 1.3.x before 1.3.8 allows remote attackers to cause a denial of service\n(crash) via vectors related to the GCM ciphersuites, as demonstrated using\nthe Codenomicon Defensics toolkit.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=754655>\n", "cvss3": {}, "published": "2014-07-22T00:00:00", "type": "ubuntucve", "title": "CVE-2014-4911", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-07-22T00:00:00", "id": "UB:CVE-2014-4911", "href": "https://ubuntu.com/security/CVE-2014-4911", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-11-22T21:50:23", "description": "The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0\nthrough 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a\npointer in the asn1_sequence linked list, which allows remote attackers to\ncause a denial of service (crash) or possibly execute arbitrary code via a\ncrafted ASN.1 sequence in a certificate.\n\n#### Bugs\n\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775776>\n", "cvss3": {}, "published": "2015-01-27T00:00:00", "type": "ubuntucve", "title": "CVE-2015-1182", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-27T00:00:00", "id": "UB:CVE-2015-1182", "href": "https://ubuntu.com/security/CVE-2015-1182", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T14:20:17", "description": "The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.", "cvss3": {}, "published": "2013-10-04T17:55:00", "type": "cve", "title": "CVE-2013-5915", "cwe": ["CWE-310"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-31T03:35:00", "cpe": ["cpe:/a:polarssl:polarssl:1.1.5", "cpe:/a:polarssl:polarssl:1.1.8", "cpe:/a:polarssl:polarssl:0.10.1", "cpe:/a:polarssl:polarssl:0.14.0", "cpe:/a:polarssl:polarssl:1.2.0", "cpe:/a:polarssl:polarssl:0.11.1", "cpe:/a:polarssl:polarssl:1.1.2", "cpe:/a:polarssl:polarssl:1.0.0", "cpe:/a:polarssl:polarssl:0.12.0", "cpe:/a:polarssl:polarssl:0.14.3", "cpe:/a:polarssl:polarssl:1.2.1", "cpe:/a:polarssl:polarssl:1.2.3", "cpe:/a:polarssl:polarssl:1.2.5", "cpe:/a:polarssl:polarssl:1.2.8", "cpe:/a:polarssl:polarssl:0.10.0", "cpe:/a:polarssl:polarssl:1.1.1", "cpe:/a:polarssl:polarssl:0.99", "cpe:/a:polarssl:polarssl:0.11.0", "cpe:/a:polarssl:polarssl:0.12.1", "cpe:/a:polarssl:polarssl:1.1.3", "cpe:/a:polarssl:polarssl:1.2.7", "cpe:/a:polarssl:polarssl:1.2.4", "cpe:/a:polarssl:polarssl:0.13.1", "cpe:/a:polarssl:polarssl:1.1.0", "cpe:/a:polarssl:polarssl:1.2.6", "cpe:/a:polarssl:polarssl:1.2.2", "cpe:/a:polarssl:polarssl:1.1.6", "cpe:/a:polarssl:polarssl:1.1.4", "cpe:/a:polarssl:polarssl:0.14.2"], "id": "CVE-2013-5915", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5915", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:polarssl:polarssl:0.11.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.14.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.99:pre1:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.10.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.99:pre5:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.12.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.99:pre3:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.14.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.13.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.14.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.99:pre4:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.10.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.12.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:0.11.0:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T13:30:13", "description": "The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.", "cvss3": {}, "published": "2014-07-22T14:55:00", "type": "cve", "title": "CVE-2014-4911", "cwe": ["CWE-310"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2015-12-04T16:21:00", "cpe": ["cpe:/a:polarssl:polarssl:1.2.3", "cpe:/a:polarssl:polarssl:1.3.6", "cpe:/a:polarssl:polarssl:1.3.7", "cpe:/a:polarssl:polarssl:1.2.9", "cpe:/a:polarssl:polarssl:1.2.7", "cpe:/a:polarssl:polarssl:1.3.5", "cpe:/a:polarssl:polarssl:1.2.0", "cpe:/o:debian:debian_linux:8.0", "cpe:/a:polarssl:polarssl:1.3.4", "cpe:/o:debian:debian_linux:7.0", "cpe:/a:polarssl:polarssl:1.2.2", "cpe:/a:polarssl:polarssl:1.3.1", "cpe:/a:polarssl:polarssl:1.2.4", "cpe:/a:polarssl:polarssl:1.3.2", "cpe:/a:polarssl:polarssl:1.3.3", "cpe:/a:polarssl:polarssl:1.2.5", "cpe:/o:debian:debian_linux:6.0", "cpe:/a:polarssl:polarssl:1.2.8", "cpe:/a:polarssl:polarssl:1.2.6", "cpe:/a:polarssl:polarssl:1.2.10", "cpe:/a:polarssl:polarssl:1.2.1", "cpe:/a:polarssl:polarssl:1.3.0"], "id": "CVE-2014-4911", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4911", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:polarssl:polarssl:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.6:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T15:09:35", "description": "Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.", "cvss3": {}, "published": "2015-08-24T15:59:00", "type": "cve", "title": "CVE-2014-8628", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628", "CVE-2014-9744"], "modified": "2017-11-04T01:29:00", "cpe": ["cpe:/a:polarssl:polarssl:1.3.5", "cpe:/a:polarssl:polarssl:1.3.4", "cpe:/a:polarssl:polarssl:1.3.1", "cpe:/a:polarssl:polarssl:1.3.2", "cpe:/a:polarssl:polarssl:1.2.11", "cpe:/a:polarssl:polarssl:1.3.6", "cpe:/a:polarssl:polarssl:1.3.7", "cpe:/a:polarssl:polarssl:1.3.3", "cpe:/a:polarssl:polarssl:1.3.8", "cpe:/a:polarssl:polarssl:1.3.0"], "id": "CVE-2014-8628", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8628", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:a:polarssl:polarssl:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.2:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T15:38:30", "description": "Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.", "cvss3": {}, "published": "2015-08-24T15:59:00", "type": "cve", "title": "CVE-2014-9744", "cwe": ["CWE-399"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628", "CVE-2014-9744"], "modified": "2018-10-30T16:27:00", "cpe": ["cpe:/a:polarssl:polarssl:1.3.8", "cpe:/o:opensuse:opensuse:13.2"], "id": "CVE-2014-9744", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9744", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}, "cpe23": ["cpe:2.3:a:polarssl:polarssl:1.3.8:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T11:52:15", "description": "The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.", "cvss3": {}, "published": "2015-01-27T20:59:00", "type": "cve", "title": "CVE-2015-1182", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2018-10-30T16:27:00", "cpe": ["cpe:/a:polarssl:polarssl:1.3.0", "cpe:/a:polarssl:polarssl:1.2.10", "cpe:/a:polarssl:polarssl:1.3.3", "cpe:/a:polarssl:polarssl:1.2.1", "cpe:/a:polarssl:polarssl:1.1.2", "cpe:/a:polarssl:polarssl:1.2.4", "cpe:/a:polarssl:polarssl:1.2.12", "cpe:/o:opensuse:opensuse:13.2", "cpe:/a:polarssl:polarssl:1.2.0", "cpe:/a:polarssl:polarssl:1.2.6", "cpe:/a:polarssl:polarssl:1.2.7", "cpe:/a:polarssl:polarssl:1.1.6", "cpe:/a:polarssl:polarssl:1.1.3", "cpe:/a:polarssl:polarssl:1.1.4", "cpe:/a:polarssl:polarssl:1.1.7", "cpe:/a:polarssl:polarssl:1.3.2", "cpe:/a:polarssl:polarssl:1.3.5", "cpe:/a:polarssl:polarssl:1.2.3", "cpe:/a:polarssl:polarssl:1.3.7", "cpe:/a:polarssl:polarssl:1.2.11", "cpe:/a:polarssl:polarssl:1.2.8", "cpe:/a:polarssl:polarssl:1.3.4", "cpe:/a:polarssl:polarssl:1.2.9", "cpe:/a:polarssl:polarssl:1.3.6", "cpe:/a:polarssl:polarssl:1.3.8", "cpe:/a:polarssl:polarssl:1.1.8", "cpe:/a:polarssl:polarssl:1.3.1", "cpe:/a:polarssl:polarssl:1.1.0", "cpe:/a:polarssl:polarssl:1.3.9", "cpe:/a:polarssl:polarssl:1.1.5", "cpe:/a:polarssl:polarssl:1.2.2", "cpe:/a:polarssl:polarssl:1.0.0", "cpe:/a:polarssl:polarssl:1.1.1", "cpe:/a:polarssl:polarssl:1.2.5"], "id": "CVE-2015-1182", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1182", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:polarssl:polarssl:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:alpha1:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:rc1:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.9:*:*:*:*:*:*:*", "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.1.0:rc0:*:*:*:*:*:*", "cpe:2.3:a:polarssl:polarssl:1.0.0:*:*:*:*:*:*:*"]}], "freebsd": [{"lastseen": "2022-01-19T15:51:32", "description": "\n\nPolarSSL Project reports:\n\nThe researchers Cyril Arnaud and Pierre-Alain Fouque\n\t investigated the PolarSSL RSA implementation and discovered\n\t a bias in the implementation of the Montgomery multiplication\n\t that we used. For which they then show that it can be used to\n\t mount an attack on the RSA key. Although their test attack is\n\t done on a local system, there seems to be enough indication\n\t that this can properly be performed from a remote system as\n\t well.\nAll versions prior to PolarSSL 1.2.9 and 1.3.0 are affected\n\t if a third party can send arbitrary handshake messages to your\n\t server.\nIf correctly executed, this attack reveals the entire private\n\t RSA key after a large number of attack messages (> 600.000 on\n\t a local machine) are sent to show the timing differences.\n\n\n", "cvss3": {}, "published": "2013-10-01T00:00:00", "type": "freebsd", "title": "polarssl -- Timing attack against protected RSA-CRT implementation", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-5915"], "modified": "2013-10-01T00:00:00", "id": "CCEFAC3E-2AED-11E3-AF10-000C29789CB5", "href": "https://vuxml.freebsd.org/freebsd/ccefac3e-2aed-11e3-af10-000c29789cb5.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2022-01-19T15:51:32", "description": "\n\nPolarSSL team reports:\n\nDuring the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not\n\t initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a\n\t situation is created where the uninitialized pointer is passed to polarssl_free().\nThis sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this\n\t means clients when receiving a certificate from the server or servers in case they are actively\n\t asking for a client certificate.\n\n\n", "cvss3": {}, "published": "2015-01-14T00:00:00", "type": "freebsd", "title": "polarssl -- Remote attack using crafted certificates", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-14T00:00:00", "id": "A5856EBA-A015-11E4-A680-1C6F65C3C4FF", "href": "https://vuxml.freebsd.org/freebsd/a5856eba-a015-11e4-a680-1c6f65c3c4ff.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2021-10-21T22:59:53", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3116-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nDecember 30, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nCVE ID : CVE-2014-8628\n\nIt was discovered that a memory leak in parsing X.509 certificates may \nresult in denial of service.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u4.\n\nFor the upcoming stable distribution (jessie), this problem has been\nfixed in version 1.3.9-1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.9-1.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-12-30T01:19:54", "type": "debian", "title": "[SECURITY] [DSA 3116-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628"], "modified": "2014-12-30T01:19:54", "id": "DEBIAN:DSA-3116-1:DEFBB", "href": "https://lists.debian.org/debian-security-announce/2014/msg00307.html", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-10-23T22:32:58", "description": "Package : polarssl\nVersion : 1.2.9-1~deb6u3\nCVE ID : CVE-2014-8628\n\nIt was discovered that a memory leak in parsing X.509 certificates may\nresult in denial of service.", "cvss3": {}, "published": "2015-01-03T21:32:56", "type": "debian", "title": "[SECURITY] [DLA 129-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628"], "modified": "2015-01-03T21:32:56", "id": "DEBIAN:DLA-129-1:D0542", "href": "https://lists.debian.org/debian-lts-announce/2015/01/msg00001.html", "cvss": {"score": 7.8, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2021-12-03T12:03:29", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2981-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nJuly 18, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nCVE ID : CVE-2014-4911\nDebian Bug : 754655\n\nA flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 1.3.7-2.1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.7-2.1.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-07-18T15:26:02", "type": "debian", "title": "[SECURITY] [DSA 2981-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-07-18T15:26:02", "id": "DEBIAN:DSA-2981-1:B676B", "href": "https://lists.debian.org/debian-security-announce/2014/msg00163.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-10-21T23:05:43", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2981-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nJuly 18, 2014 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nCVE ID : CVE-2014-4911\nDebian Bug : 754655\n\nA flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\nlibrary, which can be exploited by a remote unauthenticated attacker to\nmount a denial of service against PolarSSL servers that offer GCM\nciphersuites. Potentially clients are affected too if a malicious server\ndecides to execute the denial of service attack against its clients.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u3.\n\nFor the testing distribution (jessie), this problem has been fixed in\nversion 1.3.7-2.1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.3.7-2.1.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2014-07-18T15:26:02", "type": "debian", "title": "[SECURITY] [DSA 2981-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-07-18T15:26:02", "id": "DEBIAN:DSA-2981-1:DB405", "href": "https://lists.debian.org/debian-security-announce/2014/msg00163.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-11-30T17:08:32", "description": "Package : polarssl\nVersion : 1.2.9-1~deb6u2\nCVE ID : CVE-2014-4911\nDebian Bug : #754655\n\nDenial of Service against GCM enabled servers (and clients).", "cvss3": {}, "published": "2014-08-11T17:31:44", "type": "debian", "title": "[DLA 36-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-08-11T17:31:44", "id": "DEBIAN:DLA-36-1:970BC", "href": "https://lists.debian.org/debian-lts-announce/2014/08/msg00010.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-10-23T22:40:13", "description": "Package : polarssl\nVersion : 1.2.9-1~deb6u2\nCVE ID : CVE-2014-4911\nDebian Bug : #754655\n\nDenial of Service against GCM enabled servers (and clients).", "cvss3": {}, "published": "2014-08-11T17:31:44", "type": "debian", "title": "[DLA 36-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-4911"], "modified": "2014-08-11T17:31:44", "id": "DEBIAN:DLA-36-1:45718", "href": "https://lists.debian.org/debian-lts-announce/2014/08/msg00010.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-11-30T11:41:50", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3136-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nJanuary 24, 2015 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nCVE ID : CVE-2015-1182\nDebian Bug : 775776\n\nA vulnerability was discovered in PolarSSL, a lightweight crypto and\nSSL/TLS library. A remote attacker could exploit this flaw using\nspecially crafted certificates to mount a denial of service against an\napplication linked against the library (application crash), or\npotentially, to execute arbitrary code.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u5.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2015-01-24T09:22:14", "type": "debian", "title": "[SECURITY] [DSA 3136-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-24T09:22:14", "id": "DEBIAN:DSA-3136-1:5CEF5", "href": "https://lists.debian.org/debian-security-announce/2015/msg00019.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-21T22:58:48", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3136-1 security@debian.org\nhttp://www.debian.org/security/ Salvatore Bonaccorso\nJanuary 24, 2015 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nCVE ID : CVE-2015-1182\nDebian Bug : 775776\n\nA vulnerability was discovered in PolarSSL, a lightweight crypto and\nSSL/TLS library. A remote attacker could exploit this flaw using\nspecially crafted certificates to mount a denial of service against an\napplication linked against the library (application crash), or\npotentially, to execute arbitrary code.\n\nFor the stable distribution (wheezy), this problem has been fixed in\nversion 1.2.9-1~deb7u5.\n\nFor the upcoming stable distribution (jessie) and the unstable\ndistribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2015-01-24T09:22:14", "type": "debian", "title": "[SECURITY] [DSA 3136-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-24T09:22:14", "id": "DEBIAN:DSA-3136-1:91437", "href": "https://lists.debian.org/debian-security-announce/2015/msg00019.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-23T22:32:13", "description": "Package : polarssl\nVersion : 1.2.9-1~deb6u4\nCVE ID : CVE-2015-1182\n\nA vulnerability was discovered in PolarSSL, a lightweight crypto and\nSSL/TLS library. A remote attacker could exploit this flaw using\nspecially crafted certificates to mount a denial of service against an\napplication linked against the library (application crash), or\npotentially, to execute arbitrary code.", "cvss3": {}, "published": "2015-01-29T18:54:45", "type": "debian", "title": "[SECURITY] [DLA 144-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-29T18:54:45", "id": "DEBIAN:DLA-144-1:50BA1", "href": "https://lists.debian.org/debian-lts-announce/2015/01/msg00018.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-10-21T23:26:44", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2782-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nOctober 20, 2013 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : polarssl\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2013-4623 CVE-2013-5914 CVE-2013-5915\n\nMultiple security issues have been discovered in PolarSSL, a lightweight \ncrypto and SSL/TLS library:\n\nCVE-2013-4623\n\n Jack Lloyd discovered a denial of service vulnerability in the \n parsing of PEM-encoded certificates.\n\nCVE-2013-5914\n\n Paul Brodeur and TrustInSoft discovered a buffer overflow in the\n ssl_read_record() function, allowing the potential execution of\n arbitrary code.\n\nCVE-2013-5915\n\n Cyril Arnaud and Pierre-Alain Fouque discovered timimg attacks against\n the RSA implementation.\n\nFor the oldstable distribution (squeeze), these problems will be fixed in\nversion 1.2.9-1~deb6u1 soon (due to a technical limitation the updates\ncannot be released synchronously).\n\nFor the stable distribution (wheezy), these problems have been fixed in\nversion 1.2.9-1~deb7u1.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 1.3.1-1.\n\nWe recommend that you upgrade your polarssl packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2013-10-20T16:41:19", "type": "debian", "title": "[SECURITY] [DSA 2782-1] polarssl security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4623", "CVE-2013-5914", "CVE-2013-5915"], "modified": "2013-10-20T16:41:19", "id": "DEBIAN:DSA-2782-1:1D605", "href": "https://lists.debian.org/debian-security-announce/2013/msg00193.html", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:09:58", "bulletinFamily": "software", "cvelist": ["CVE-2014-8628"], "description": "Memory leak on certificate parsing.", "edition": 1, "modified": "2014-12-30T00:00:00", "published": "2014-12-30T00:00:00", "id": "SECURITYVULNS:VULN:14188", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14188", "title": "PolarSSL DoS", "type": "securityvulns", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:56", "bulletinFamily": "software", "cvelist": ["CVE-2014-8628"], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-3116-1 security@debian.org\r\nhttp://www.debian.org/security/ Moritz Muehlenhoff\r\nDecember 30, 2014 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : polarssl\r\nCVE ID : CVE-2014-8628\r\n\r\nIt was discovered that a memory leak in parsing X.509 certificates may \r\nresult in denial of service.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, this problem has been fixed in\r\nversion 1.2.9-1~deb7u4.\r\n\r\nFor the upcoming stable distribution &#40;jessie&#41;, this problem has been\r\nfixed in version 1.3.9-1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 1.3.9-1.\r\n\r\nWe recommend that you upgrade your polarssl packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: https://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBAgAGBQJUof1xAAoJEBDCk7bDfE42TrkP/A7Iw+HG6yaSV3DZ4THEAesN\r\nsMApQQT2IyQ/YjxZ+RGKCgowQiiO+eVVYBjM4v0SafIKWHlcvsPIjMXqDHGR6+Dz\r\ngzUAQ1vHBiWw5gI7Ix7dv8jgV0s2yKaSr6YTLBzDbNX6AmUCIaXbZgKe7wTSAf2u\r\n5kuSoPXb+Vf9I08md6hFbEPvEJfnTZFaqiXl+2nRX2NzDBQGQXzyBbr7aPz06+nl\r\nEVE20HClcKqjusCVaB4KCc9if1D3PswxgbdLIpg0BvVfO7ZugZeaZ4A1QHUVUxm0\r\nm4FxAVDXcmQDBIlgKScT/0tgjUOElpVGGjoE4m6tM3gqULVCdw1NPxJm9vd8sglm\r\n462aYOB75hHrKqyR37h6/1t+3dpt9tq1V8ZY931CucnbEnq3xWSkkIKXkFMMIN7R\r\nasXGNanoLVwkLwF5oylqy+asCHW66m00rJmet4b1ZjKNCIdGD7z/QjCymNWXg7Ya\r\nrXtQn7w7qAlijiNPsvnQnh4Rd1QeNYuqpZ7prYvRfcafhPHX1DwQFR3zSnzMxqL6\r\nUNyjOiO4ZWRIWUPJYtGh8j7OnXTlBaRWibzUCSoYE83kvM0lPC/MLy5RQ2BripaO\r\nIk7n++UFVGKtW6wbSI8qLB5H5MOWRl78d8J6Yt7hUcHX/at9+dczbq+h5guXXJwX\r\nl78i+xR59Y4GHHoaUiEN\r\n=6w3n\r\n-----END PGP SIGNATURE-----\r\n\r\n", "edition": 1, "modified": "2014-12-30T00:00:00", "published": "2014-12-30T00:00:00", "id": "SECURITYVULNS:DOC:31581", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:31581", "title": "[SECURITY] [DSA 3116-1] polarssl security update", "type": "securityvulns", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:09:56", "bulletinFamily": "software", "cvelist": ["CVE-2014-4911"], "description": "DoS on GCM cypher.", "edition": 1, "modified": "2014-07-22T00:00:00", "published": "2014-07-22T00:00:00", "id": "SECURITYVULNS:VULN:13880", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13880", "title": "PolarSSL DoS", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:52", "bulletinFamily": "software", "cvelist": ["CVE-2014-4911"], "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA512\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2981-1 security@debian.org\r\nhttp://www.debian.org/security/ Salvatore Bonaccorso\r\nJuly 18, 2014 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : polarssl\r\nCVE ID : CVE-2014-4911\r\nDebian Bug : 754655\r\n\r\nA flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS\r\nlibrary, which can be exploited by a remote unauthenticated attacker to\r\nmount a denial of service against PolarSSL servers that offer GCM\r\nciphersuites. Potentially clients are affected too if a malicious server\r\ndecides to execute the denial of service attack against its clients.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, this problem has been fixed in\r\nversion 1.2.9-1~deb7u3.\r\n\r\nFor the testing distribution &#40;jessie&#41;, this problem has been fixed in\r\nversion 1.3.7-2.1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 1.3.7-2.1.\r\n\r\nWe recommend that you upgrade your polarssl packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1\r\n\r\niQIcBAEBCgAGBQJTyTxWAAoJEAVMuPMTQ89EOtgP/jQTbv+uZvjTH1pW9YWdRifE\r\n1u1uqWvBhMySn/SpOi1M8gG8SbI0J3Zf2hhe619GWQTizIGyCsDf912j5EYMPZct\r\nU+4GkGZvH6JSREHFHgzsj4Y284mO6tr4gEmx053tx1JyY4ZE4QCDwVWjXUw/jl6e\r\nvi68m4vf/ul3Bo0oo4eivkAVewQf8zCf4M/nvpL0vKVRVzBaca8K9tEWNdN5vYvJ\r\nMfjF35k6QmHlx1ntr9QwwaUPvuzhDE83CXtdNqKHvIiu31Q1sH7fDWHb+2EXQnJZ\r\nqAa9a4Xz/cCNHNDYJdZKMqQ801b/FAE+WpMv/p+iKZJ+b8Qe4hi1jxnZFSCI8s5S\r\nIAOiyM/xETZGjqywWxIzU8WBvYVRWZX82wL01Pq0uNMhNpdLC1PAV0ayi//4z0iK\r\nEp6O70bCAqxEUpNv71CWJdP/uZg38PCNiDgnV4Il6bXPVpW13l3nWzDKvQmLepdg\r\n32CJ2b93HG4oB9dK5PrAAXsI4q9H0pJihF4oSzqYrxvtk6kN5QGszTguCWNh0zlg\r\nVGgejjww5zKO9vyJdaDoiCn+qBVL08FlTPEMBArulh3R+6D1ih8ftPDlZbNRVQXb\r\nFCPqqZRIeIGBMPGGwmaTMrlC3QGjhJILJxqu5/SpCqGlG+/90cYDrlOwB/9oXtNn\r\nuDyFK2A4oQPutCpJLH91\r\n=/4R/\r\n-----END PGP SIGNATURE-----\r\n\r\n", "edition": 1, "modified": "2014-07-22T00:00:00", "published": "2014-07-22T00:00:00", "id": "SECURITYVULNS:DOC:30941", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:30941", "title": "[SECURITY] [DSA 2981-1] polarssl security update", "type": "securityvulns", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2021-06-08T19:09:55", "description": "DoS, buffer overflows, timing attacks.", "edition": 2, "cvss3": {}, "published": "2013-10-28T00:00:00", "title": "PolarSSL multiple security vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2013-5914", "CVE-2013-4623"], "modified": "2013-10-28T00:00:00", "id": "SECURITYVULNS:VULN:13381", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13381", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:49", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2782-1 security@debian.org\r\nhttp://www.debian.org/security/ Moritz Muehlenhoff\r\nOctober 20, 2013 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : polarssl\r\nVulnerability : several\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2013-4623 CVE-2013-5914 CVE-2013-5915\r\n\r\nMultiple security issues have been discovered in PolarSSL, a lightweight \r\ncrypto and SSL/TLS library:\r\n\r\nCVE-2013-4623\r\n\r\n Jack Lloyd discovered a denial of service vulnerability in the \r\n parsing of PEM-encoded certificates.\r\n\r\nCVE-2013-5914\r\n\r\n Paul Brodeur and TrustInSoft discovered a buffer overflow in the\r\n ssl_read_record&#40;&#41; function, allowing the potential execution of\r\n arbitrary code.\r\n\r\nCVE-2013-5915\r\n\r\n Cyril Arnaud and Pierre-Alain Fouque discovered timimg attacks against\r\n the RSA implementation.\r\n\r\nFor the oldstable distribution &#40;squeeze&#41;, these problems will be fixed in\r\nversion 1.2.9-1~deb6u1 soon &#40;due to a technical limitation the updates\r\ncannot be released synchronously&#41;.\r\n\r\nFor the stable distribution &#40;wheezy&#41;, these problems have been fixed in\r\nversion 1.2.9-1~deb7u1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, these problems have been fixed in\r\nversion 1.3.1-1.\r\n\r\nWe recommend that you upgrade your polarssl packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n\r\n\r\n\r\n\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.15 &#40;GNU/Linux&#41;\r\n\r\niEYEARECAAYFAlJkB2wACgkQXm3vHE4uylpw4wCgviIBtPeDGMTJnYSKl+Nts1wl\r\nhQsAoMMlNgR/ksIHwiSoiIVla+xTyRTE\r\n=sY+z\r\n-----END PGP SIGNATURE-----\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2013-10-28T00:00:00", "title": "[SECURITY] [DSA 2782-1] polarssl security update", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-5915", "CVE-2013-5914", "CVE-2013-4623"], "modified": "2013-10-28T00:00:00", "id": "SECURITYVULNS:DOC:29976", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29976", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "archlinux": [{"lastseen": "2016-09-02T18:44:48", "description": "- CVE-2014-8627 (weak signature negotiation)\nA mistake resulted in servers negotiating the lowest common hash from\nsignature_algorithms extension in TLS 1.2.\n\n- CVE-2014-8628 (memory leaks)\nTwo issues were found that result in remotely triggerable memory leaks\nwhen parsing crafted ClientHello messages or X.509 certificates.", "edition": 2, "cvss3": {}, "published": "2014-11-06T00:00:00", "type": "archlinux", "title": "polarssl: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.8, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-8628", "CVE-2014-8627"], "modified": "2014-11-06T00:00:00", "id": "ASA-201411-4", "href": "https://lists.archlinux.org/pipermail/arch-security/2014-November/000129.html", "cvss": {"score": 7.8, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:COMPLETE/"}}, {"lastseen": "2016-09-02T18:44:45", "description": "During the parsing of a ASN.1 sequence, a pointer in the linked list of\nasn1_sequence is not initialized by asn1_get_sequence_of(). In case an\nerror occurs during parsing of the list, a situation is created where\nthe uninitialized pointer is passed to polarssl_free().\n\nThis sequence can be triggered when a PolarSSL entity is parsing a\ncertificate. So practically this means clients when receiving a\ncertificate from the server or servers in case they are actively asking\nfor a client certificate.", "edition": 2, "cvss3": {}, "published": "2015-01-20T00:00:00", "type": "archlinux", "title": "polarssl: remote code execution", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182"], "modified": "2015-01-20T00:00:00", "id": "ASA-201501-13", "href": "https://lists.archlinux.org/pipermail/arch-security/2015-January/000209.html", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2022-01-17T19:04:37", "description": "### Background\n\nPolarSSL is a cryptographic library for embedded systems.\n\n### Description\n\nMultiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker might be able to execute arbitrary code, cause Denial of Service condition or obtain sensitive information. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nGentoo has discontinued support for PolarSSL and recommends that users unmerge the package: \n \n \n # emerge --unmerge \"net-libs/polarssl\"", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.9, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-01-15T00:00:00", "type": "gentoo", "title": "PolarSSL: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2015-1182", "CVE-2015-7575"], "modified": "2018-01-15T00:00:00", "id": "GLSA-201801-15", "href": "https://security.gentoo.org/glsa/201801-15", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-01-17T19:10:11", "description": "### Background\n\nPolarSSL is a cryptographic library for embedded systems.\n\n### Description\n\nMultiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker might be able to cause Denial of Service, conduct a man-in-the middle attack, compromise an encrypted communication channel, or obtain sensitive information. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll PolarSSL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/polarssl-1.3.0\"", "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.4, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.2}, "published": "2013-10-17T00:00:00", "type": "gentoo", "title": "PolarSSL: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-1923", "CVE-2012-2130", "CVE-2013-0169", "CVE-2013-1621", "CVE-2013-4623", "CVE-2013-5915"], "modified": "2013-10-17T00:00:00", "id": "GLSA-201310-10", "href": "https://security.gentoo.org/glsa/201310-10", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}]}