Vulnerabilities > Polarssl > Polarssl > 0.13.1
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-10-27 | CVE-2011-4574 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Polarssl PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. | 7.5 |
| 2015-11-02 | CVE-2015-8036 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. | 6.8 |
| 2015-08-24 | CVE-2014-9744 | Resource Management Errors vulnerability in multiple products Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. | 7.8 |
| 2014-07-22 | CVE-2014-4911 | Cryptographic Issues vulnerability in multiple products The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit. | 5.0 |
| 2013-10-26 | CVE-2013-5914 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Polarssl Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet. | 6.8 |
| 2013-10-04 | CVE-2013-5915 | Cryptographic Issues vulnerability in Polarssl The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys. | 4.3 |
| 2013-02-08 | CVE-2013-1621 | Improper Input Validation vulnerability in Polarssl Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169. | 4.3 |
| 2012-06-20 | CVE-2011-1923 | Cryptographic Issues vulnerability in Polarssl The Diffie-Hellman key-exchange implementation in dhm.c in PolarSSL before 0.14.2 does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-5095. | 4.0 |