CVE-2015-1182
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x...
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Exploit likelihood
What each source reports
NVD Score used
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
- Record
CVE-2015-1182- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
- Record
CVE-2015-1182- Updated
- 2026-11-02
EUVDEUVD-2015-1324 No score
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
- Record
EUVD-2015-1324- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8g33-q77c-23f6 No score
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x...
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
- Record
GHSA-8g33-q77c-23f6- Updated
- 2026-11-02
OSVMGASA-2015-0055 No score
Updated polarssl packages fix CVE-2015-1182
Updated polarssl packages fix security vulnerability:
A vulnerability was discovered in PolarSSL in its certificate parser. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library (application crash), or potentially, to execute arbitrary code (CVE-2015-1182).
- Record
MGASA-2015-0055- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10088-1 No score
libmbedcrypto0-2.4.0-1.2 on GA media
These are all security issues fixed in the libmbedcrypto0-2.4.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10088-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12903-1 No score
libmbedcrypto7-2.28.3-1.1 on GA media
These are all security issues fixed in the libmbedcrypto7-2.28.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12903-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11119-1 No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11119-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
polarsslDebian:6.0 |
before 1.2.9-1~deb6u4, plus listed versions 0.12.1-10.12.1-1squeeze10.14.3-11.0.0-11.0.0-2 Show 20 moreShow less1.0.0-2+s390x1.0.0-31.1.0-11.1.1-11.1.2-11.1.3-11.1.4-11.1.4-21.2.0-11.2.2-11.2.3-11.2.4-11.2.5-11.2.6-11.2.7-11.2.8-11.2.8-21.2.9-1~deb6u11.2.9-1~deb6u21.2.9-1~deb6u3 |
1.2.9-1~deb6u4 |
polarsslDebian:7 |
before 1.2.9-1~deb7u5, plus listed versions 1.1.4-21.2.0-11.2.2-11.2.3-11.2.4-1 Show 14 moreShow less1.2.5-11.2.6-11.2.7-11.2.8-11.2.8-21.2.9-1~deb6u11.2.9-1~deb6u21.2.9-1~deb6u31.2.9-1~deb6u41.2.9-1~deb6u51.2.9-1~deb7u11.2.9-1~deb7u21.2.9-1~deb7u31.2.9-1~deb7u4 |
1.2.9-1~deb7u5 |
polarsslMageia:4 |
before 1.3.9-1.1.mga4 | 1.3.9-1.1.mga4 |
mbedtlsopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.4.0-1.2 | 2.4.0-1.2 |
mbedtls-2openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 2.28.3-1.1 | 2.28.3-1.1 |
mbedtls-3openSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.6.6-1.1 | 3.6.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-1182 is a high vulnerability (CVSS 7.5) in Polarssl, published January 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.10%, the 87th percentile. Fixed in polarssl 1.2.9-1~deb6u4.
References
lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html
secunia.com/advisories/62270
lists.opensuse.org/opensuse-updates/2015-02/msg00003.html
security.gentoo.org/glsa/201801-15
Show 20 moreShow less
polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04
debian.org/security/2015/dsa-3136
nvd.nist.gov/vuln/detail/CVE-2015-1182
github.com/advisories/GHSA-8g33-q77c-23f6
advisories.mageia.org/MGASA-2015-0055.html
bugs.mageia.org/show_bug.cgi?id=15137
suse.com/security/cve/CVE-2014-8627