polarssl - several

Multiple vulnerabilities have been found in PolarSSL. The Common
Vulnerabilities and Exposures project identifies the following issues:

• CVE-2013-0169
  A timing side channel attack has been found in CBC padding
  allowing an attacker to recover pieces of plaintext via statistical
  analysis of crafted packages, known as the Lucky Thirteen issue.
• CVE-2013-1621
  An array index error might allow remote attackers to cause a denial
  of service via vectors involving a crafted padding-length value
  during validation of CBC padding in a TLS session.
• CVE-2013-1622
  Malformed CBC data in a TLS session could allow remote attackers to
  conduct distinguishing attacks via statistical analysis of timing
  side-channel data for crafted packets.

For the stable distribution (squeeze), these problems have been fixed in
version 0.12.1-1squeeze1.

For the testing distribution (wheezy), and the unstable distribution
(sid), these problems have been fixed in version 1.1.4-2.

We recommend that you upgrade your polarssl packages.