VulnerabilityModified
CVE-2013-5914
Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet.
MEDIUM 6.8EPSS 3.00%
Does this matter?
Lower severity and a low EPSS score (3.00%). Track it; it rarely justifies an emergency change on its own.
Description
Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.00% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- polarssl/polarssl
- Source
- cve@mitre.org
References
- http://www.debian.org/security/2013/dsa-2782
- https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04Patch, Vendor Advisory
- http://www.debian.org/security/2013/dsa-2782
- https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.