OpenSSL -- multiple vulnerabilities

OpenSSL reports: High: OCSP Status Request extension unbounded memory growth SSLpeek hang on empty record SWEET32 Mitigation OOB write in MDC2Update Malformed SHA512 ticket DoS OOB write in BNbn2dec OOB read in TSOBJprintbio Pointer arithmetic undefined behaviour Constant time flag not preserved ...

Vulnerability in OpenSSL - Certificate message OOB reads

In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms. The messages affected are client certificate, client certificate...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

The x509parsecrt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service infinite loop and CPU consumption via a certificate message that contains...

CVE-2013-4623

CVE-2013-4623 concerns PolarSSL’s x509parse_crt parsing during the SSL/TLS handshake. The vulnerability affects PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8, where a certificate message containing a PEM-encoded certificate can trigger an infinite loop and high CPU usage, enabling a remote d...