Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.

It was discovered that a memory leak in parsing X.509 certificates may result in denial of service.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a memory leak in parsing X.509 certificates may result in denial of service.

- Update to 1.2.12

    - CVE-2014-8628 (#1159845)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

polarssl was updated to version 1.3.9 to fix two security issues.

These security issues were fixed :

  - Lowest common hash was selected from     signature_algorithms extension in TLS 1.2     (CVE-2014-8627).

  - Remotely-triggerable memory leak when parsing some X.509     certificates (CVE-2014-8628).

ID	Name	Product	Family	Severity
82112	Debian DLA-129-1 : polarssl security update	Nessus	Debian Local Security Checks	high
80307	Debian DSA-3116-1 : polarssl - security update	Nessus	Debian Local Security Checks	high
79395	Fedora 19 : polarssl-1.2.12-1.fc19 (2014-14912)	Nessus	Fedora Local Security Checks	high
79394	Fedora 20 : polarssl-1.2.12-1.fc20 (2014-14898)	Nessus	Fedora Local Security Checks	high
79348	openSUSE Security Update : polarssl (openSUSE-SU-2014:1457-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2014-8628

high

Tenable Plugins

high

high

high

high

high