CVE-2014-8628
HighSummary
A memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service through a large number of crafted X.509 certificates.
Risk Assessment
Attackers can exploit this vulnerability to exhaust memory resources, leading to service unavailability.
Recommendation
It is recommended to update PolarSSL to the latest version to mitigate this vulnerability.
Other vulnerabilities in PolarSSL
See all- CVE-2014-9744High
A memory leak in PolarSSL before version 1.3.9 allows remote attackers to cause a denial of service through a large number of ClientHello messages.
- CVE-2015-1182High
The asn1_get_sequence_of function in the PolarSSL library from version 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which may lead to a denial of service (crash) or potentially execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Original NVD description (English source)
Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.