7.8
CVSSv2

CVE-2014-8628

Published: 24/08/2015 Updated: 07/11/2023
CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10
VMScore: 694
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Summary

Memory leak in PolarSSL prior to 1.2.12 and 1.3.x prior to 1.3.9 allows remote malicious users to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.

Vulnerable Product Search on Vulmon Subscribe to Product

polarssl polarssl 1.3.1

polarssl polarssl 1.3.4

polarssl polarssl 1.3.2

polarssl polarssl 1.3.6

polarssl polarssl 1.3.7

polarssl polarssl 1.3.3

polarssl polarssl 1.3.8

polarssl polarssl 1.3.5

polarssl polarssl

polarssl polarssl 1.3.0

Vendor Advisories

Debian Bug report logs - #801413 polarssl: CVE-2015-5291: Remote attack on clients using session tickets or SNI Package: src:polarssl; Maintainer for src:polarssl is Roland Stigge <stigge@antcomde>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 9 Oct 2015 20:03:01 UTC Severity: grave Tags: fixed- ...
It was discovered that a memory leak in parsing X509 certificates may result in denial of service For the stable distribution (wheezy), this problem has been fixed in version 129-1~deb7u4 For the upcoming stable distribution (jessie), this problem has been fixed in version 139-1 For the unstable distribution (sid), this problem has been fix ...