Vulnerabilities > Matrixssl > Matrixssl > 4.2.1
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2023-12-22 | CVE-2023-24609 | Integer Overflow or Wraparound vulnerability in multiple products Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. | 7.5 |
2023-01-18 | CVE-2022-46505 | Improper Initialization vulnerability in Matrixssl An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. | 7.5 |
2023-01-09 | CVE-2022-43974 | Integer Overflow or Wraparound vulnerability in Matrixssl MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. | 9.8 |
2020-12-30 | CVE-2019-16747 | Out-of-bounds Write vulnerability in Matrixssl In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via a crafted incoming network message, a different vulnerability than CVE-2019-14431. | 5.0 |
2019-10-03 | CVE-2019-13629 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Matrixssl MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. | 4.3 |
2019-07-29 | CVE-2019-14431 | Improper Handling of Exceptional Conditions vulnerability in Matrixssl In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. | 9.8 |