CVE catalog

CVE-2014-8628

libmbedcrypto7-2.28.3-1.1 on GA media

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.72% · Oct 25, 2026

Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpolarssl71.1.4-2vulnerable
Debianpolarssl71.2.0-1vulnerable
Debianpolarssl71.2.2-1vulnerable
Debianpolarssl71.2.3-1vulnerable
Debianpolarssl71.2.4-1vulnerable
Debianpolarssl71.2.5-1vulnerable
Debianpolarssl71.2.6-1vulnerable
Debianpolarssl71.2.7-1vulnerable
Debianpolarssl71.2.8-1vulnerable
Debianpolarssl71.2.8-2vulnerable
Debianpolarssl71.2.9-1~deb6u1vulnerable
Debianpolarssl71.2.9-1~deb6u2vulnerable
Debianpolarssl71.2.9-1~deb6u3vulnerable
Debianpolarssl71.2.9-1~deb6u4vulnerable
Debianpolarssl71.2.9-1~deb6u5vulnerable
Debianpolarssl71.2.9-1~deb7u1vulnerable
Debianpolarssl71.2.9-1~deb7u2vulnerable
Debianpolarssl71.2.9-1~deb7u3vulnerable
Debianpolarssl71.2.9-1~deb7u4fixed
Debianpolarssl6.00.12.1-1vulnerable
Debianpolarssl6.00.12.1-1squeeze1vulnerable
Debianpolarssl6.00.14.3-1vulnerable
Debianpolarssl6.01.0.0-1vulnerable
Debianpolarssl6.01.0.0-2vulnerable
Debianpolarssl6.01.0.0-2+s390xvulnerable
Debianpolarssl6.01.0.0-3vulnerable
Debianpolarssl6.01.1.0-1vulnerable
Debianpolarssl6.01.1.1-1vulnerable
Debianpolarssl6.01.1.2-1vulnerable
Debianpolarssl6.01.1.3-1vulnerable
Debianpolarssl6.01.1.4-1vulnerable
Debianpolarssl6.01.1.4-2vulnerable
Debianpolarssl6.01.2.0-1vulnerable
Debianpolarssl6.01.2.2-1vulnerable
Debianpolarssl6.01.2.3-1vulnerable
Debianpolarssl6.01.2.4-1vulnerable
Debianpolarssl6.01.2.5-1vulnerable
Debianpolarssl6.01.2.6-1vulnerable
Debianpolarssl6.01.2.7-1vulnerable
Debianpolarssl6.01.2.8-1vulnerable
Debianpolarssl6.01.2.8-2vulnerable
Debianpolarssl6.01.2.9-1~deb6u1vulnerable
Debianpolarssl6.01.2.9-1~deb6u2vulnerable
Debianpolarssl6.01.2.9-1~deb6u3fixed
Opensusembedtlstumbleweed2.4.0-1.2fixed
Opensusembedtls-2tumbleweed2.28.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpolarssldeb71.2.9-1~deb7u4Not reportedDSA-3116-1Not reported
Debianpolarssldeb6.01.2.9-1~deb6u3Not reportedDLA-129-1Not reported
Opensusembedtlsrpmtumbleweed2.4.0-1.2Not reportedOPENSUSE-SU-2024:10088-1Not reported
Opensusembedtls-2rpmtumbleweed2.28.3-1.1Not reportedOPENSUSE-SU-2024:12903-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libmbedcrypto7]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedcrypto7-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls14-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedtls23]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [libmbedtls23-x86-64-v3]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [libmbedx509-1]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-1-x86-64-v3]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [libmbedx509-9]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [libmbedx509-9-x86-64-v3]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [libtfpsacrypto2]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [libtfpsacrypto2-x86-64-v3]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

  • [mbedtls-2-devel]Unknown

    Source package: [mbedtls-2]

    Details (1)

    • 2.28.10-4.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.28.3-1.1

      Version impact unknown

      pypi · mbedtls-2 · opensuse · tumbleweed

  • [mbedtls-devel]Unknown

    Source package: [mbedtls]

    Details (1)

    • 4.2.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 2.4.0-1.2

      Version impact unknown

      pypi · mbedtls · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]