CVE-2014-9744
HighSummary
A memory leak in PolarSSL before version 1.3.9 allows remote attackers to cause a denial of service through a large number of ClientHello messages.
Risk Assessment
Attackers can exploit this vulnerability to exhaust server memory resources, leading to service unavailability.
Recommendation
It is recommended to upgrade PolarSSL to version 1.3.9 or later to mitigate this vulnerability.
Other vulnerabilities in PolarSSL
See all- CVE-2014-8628High
A memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service through a large number of crafted X.509 certificates.
- CVE-2015-1182High
The asn1_get_sequence_of function in the PolarSSL library from version 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which may lead to a denial of service (crash) or potentially execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Original NVD description (English source)
Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientHello messages. NOTE: this identifier was SPLIT from CVE-2014-8628 per ADT3 due to different affected versions.