PolarSSL: Multiple vulnerabilities

Background PolarSSL is a cryptographic library for embedded systems. Description Multiple vulnerabilities have been discovered in PolarSSL. Please review the CVE identifiers referenced below for details. Impact A remote attacker might be able to execute arbitrary code, cause Denial of Service...

DEBIAN-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

UBUNTU-CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

CVE-2017-14032

ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was formerly known as PolarSSL, the releases shipped with the PolarSSL...

FreeBSD : mbed TLS (PolarSSL) -- multiple vulnerabilities (f41e3e54-076b-11e7-a9f2-0011d823eebd)

Janos Follath reports : - If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service client crash or...

mbed TLS (PolarSSL) -- multiple vulnerabilities

Janos Follath reports: If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service client crash or...

openSUSE Security Update : polarssl (openSUSE-2016-932)

This update for polarssl fixes the following issues : - CVE-2015-8036: A heap-based buffer overflow could have allowed remote attackers to cause a denial of service or possibly execute arbitrary code via a long session ticket name to the session ticket extension boo989694 %NASLMINLEVEL 70300 C...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the accessibility of protected information

Multiple vulnerabilities exist in the polarssl operating system package from Debian GNU/Linux. Exploitation of these vulnerabilities may lead to a violation of the accessibility of protected information. These vulnerabilities can be exploited remotely...

[slackware-security] curl

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/curl-7.49.0-i486-1slack14.1.txz: Upgraded. Fixed a TLS certificate check bypass with mbedTLS/PolarSSL. For mo...

Haxx Libcurl Man-in-the-Middle Attack Vulnerability (CNVD-2016-03515)

Haxx Libcurl is a free , open source client-side URL transfer library from the Swedish company Haxx. The library supports FTP, FTPS, TFTP, HTTP and so on. A man-in-the-middle attack vulnerability exists in Haxx Libcurl versions 7.21.0 through 7.48.0, which stems from the program failing to check...

TLS certificate check bypass with mbedTLS/PolarSSL

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, or when explicitly asked to use SSLv3. This flaw only exists when libcurl is built to use mbedTLS or PolarSSL as the TLS backend. The documentation for mbedTLS and PolarSSL wrongly says that...

CURL-CVE-2016-3739 TLS certificate check bypass with mbedTLS/PolarSSL

libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, or when explicitly asked to use SSLv3. This flaw only exists when libcurl is built to use mbedTLS or PolarSSL as the TLS backend. The documentation for mbedTLS and PolarSSL wrongly says that...

Mageia: Security Advisory (MGASA-2016-0054)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3468-1 : polarssl - security update

It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service via application crash or arbitrary code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

[SECURITY] [DSA 3468-1] polarssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3468-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 06, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3468-1] polarssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3468-1 [email protected] https://www.debian.org/security/ Sebastien Delafond February 06, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3468-1 (polarssl - security update)

It was discovered that polarssl, a library providing SSL and TLS support, contained two heap-based buffer overflows that could allow a remote attacker to trigger denial of service via application crash or arbitrary code execution. OpenVAS Vulnerability Test $Id: deb3468.nasl 6608 2017-07-07...

DSA-3468-1 polarssl - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3468-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : polarssl (openSUSE-2016-60) (SLOTH)

This update for polarssl fixes the following issues : - CVE-2015-7575: Disables by default MD5 handshake signatures in TLS 1.2 to prevent the SLOTH attack on TLS 1.2 server authentication boo961284 - boo961290: potential double free during certificate generation %NASLMINLEVEL 70300 C Tenable...