CVE catalog
CVE-2015-1182
polarssl - security update
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 3.10% · Oct 25, 2026
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | polarssl | 7 | 1.1.4-2 | vulnerable |
| Debian | polarssl | 7 | 1.2.0-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.2-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.3-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.4-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.5-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.6-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.7-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.8-1 | vulnerable |
| Debian | polarssl | 7 | 1.2.8-2 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb6u1 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb6u2 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb6u3 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb6u4 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb6u5 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb7u1 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb7u2 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb7u3 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb7u4 | vulnerable |
| Debian | polarssl | 7 | 1.2.9-1~deb7u5 | fixed |
| Debian | polarssl | 6.0 | 0.12.1-1 | vulnerable |
| Debian | polarssl | 6.0 | 0.12.1-1squeeze1 | vulnerable |
| Debian | polarssl | 6.0 | 0.14.3-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.0.0-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.0.0-2 | vulnerable |
| Debian | polarssl | 6.0 | 1.0.0-2+s390x | vulnerable |
| Debian | polarssl | 6.0 | 1.0.0-3 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.0-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.1-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.2-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.3-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.4-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.1.4-2 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.0-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.2-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.3-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.4-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.5-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.6-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.7-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.8-1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.8-2 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.9-1~deb6u1 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.9-1~deb6u2 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.9-1~deb6u3 | vulnerable |
| Debian | polarssl | 6.0 | 1.2.9-1~deb6u4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | polarssl | deb | 7 | 1.2.9-1~deb7u5 | Not reported | DSA-3136-1 | Not reported |
| Debian | polarssl | deb | 6.0 | 1.2.9-1~deb6u4 | Not reported | DLA-144-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: