FreeBSD : polarssl -- Remote attack using crafted certificates (a5856eba-a015-11e4-a680-1c6f65c3c4ff)

PolarSSL team reports : During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1sequence is not initialized by asn1getsequenceof. In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarsslfree. This sequence...

polarssl: remote code execution

During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1sequence is not initialized by asn1getsequenceof. In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarsslfree. This sequence can be triggered when a...

Potential Code Execution Flaw Haunts PolarSSL Library

There is a vulnerability in PolarSSL, an open-source SSL library used in a variety of products, that could enable an attacker to execute arbitrary code under some circumstances. The vulnerability is the result of an uninitialized pointer in the PolarSSL code and researchers said that an attacker...

polarssl -- Remote attack using crafted certificates

PolarSSL team reports: During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1sequence is not initialized by asn1getsequenceof. In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarsslfree. This sequence...

PolarSSL Weak Signature Algorithm Negotiation

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, allowing remote attackers to conduct downgrade attacks. This plugin sends a list of hash algorithms SHA512, SHA384, SHA256, SHA224, SHA1, and MD5 in descending order, and checks if the server selects MD5. TRUSTED...

[SECURITY] [DLA 129-1] polarssl security update

Package : polarssl Version : 1.2.9-1deb6u3 CVE ID : CVE-2014-8628 It was discovered that a memory leak in parsing X.509 certificates may result in denial of service...

DLA-129-1 polarssl - security update

Bulletin has no description...

Debian DSA-3116-1 : polarssl - security update

It was discovered that a memory leak in parsing X.509 certificates may result in denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3116. The text itself is copyright C...

[SECURITY] [DSA 3116-1] polarssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3116-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 30, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3116-1] polarssl security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3116-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 30, 2014 http://www.debian.org/security/faq -...

PolarSSL DoS

Memory leak on certificate parsing...

Debian Security Advisory DSA 3116-1 (polarssl - security update)

It was discovered that a memory leak in parsing X.509 certificates may result in denial of service. OpenVAS Vulnerability Test $Id: deb3116.nasl 9136 2018-03-19 13:08:02Z cfischer $ Auto-generated from advisory DSA 3116-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright:...

DSA-3116-1 polarssl - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3116-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-8627

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

CVE-2014-8627

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

Code injection

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

CVE-2014-8627

CVE-2014-8627 affects PolarSSL 1.3.8 where signature algorithm negotiation is flawed, enabling downgrade-like scenarios via unspecified vectors. Public sources (NVD/NASL/Nessus/OpenVAS) describe downgrad e risk and context; a patch path is to upgrade to newer PolarSSL versions (e.g., 1.3.9) as no...

CVE-2014-8627

PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, which allows remote attackers to conduct downgrade attacks via unspecified vectors...

Fedora 19 : polarssl-1.2.12-1.fc19 (2014-14912)

Update to 1.2.12 - CVE-2014-8628 1159845 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...