{"id":"CVE-2014-4911","aliases":["DEBIAN-CVE-2014-4911","DLA-36-1","DSA-2981-1","EUVD-2014-4830","GHSA-5w2p-5ww5-p9p9","MGASA-2014-0315"],"status":"published","title":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3...","description":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02427,"percentile":0.84322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-07-18T00:00:00Z","modified":"2026-06-17T00:10:46Z","fixes":[{"ecosystem":"Debian:6.0","package":"polarssl","fixed_in":["1.2.9-1~deb6u2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"polarssl","fixed_in":["1.2.9-1~deb7u3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"polarssl","fixed_in":["1.3.8-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"pdns","fixed_in":["3.3.1-1.3.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"polarssl","fixed_in":["1.3.8-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"pdns","fixed_in":["3.3.1-2.2.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb6u2"}]}],"versions":["0.12.1-1","0.12.1-1squeeze1","0.14.3-1","1.0.0-1","1.0.0-2","1.0.0-2+s390x","1.0.0-3","1.1.0-1","1.1.1-1","1.1.2-1","1.1.3-1","1.1.4-1","1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1"]},{"source":"osv","ecosystem":"Debian:7","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb7u3"}]}],"versions":["1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1","1.2.9-1~deb6u2","1.2.9-1~deb6u3","1.2.9-1~deb6u4","1.2.9-1~deb6u5","1.2.9-1~deb7u1","1.2.9-1~deb7u2"]},{"source":"osv","ecosystem":"Mageia:3","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.3.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-2.2.mga4"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"polarssl","product":"polarssl"}],"references":[{"url":"https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-02","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2981","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/60215","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4911"},{"url":"https://github.com/advisories/GHSA-5w2p-5ww5-p9p9"},{"url":"https://advisories.mageia.org/MGASA-2014-0315.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13764","tags":["report"]},{"url":"https://polarssl.org/tech-updates/releases/polarssl-1.3.8-released","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2981","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-4911","description":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-08-06T11:27:37.011Z","updated_at":"2026-11-02T14:33:45.604635Z"}],"euvd":[{"id":"EUVD-2014-4830","description":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-08-06T11:27:37Z","updated_at":"2026-11-03T01:57:04.755556Z"}],"ghsa":[{"id":"GHSA-5w2p-5ww5-p9p9","title":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3...","description":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.","status":"published","published":"2022-05-17T04:01:16Z","modified":"2023-01-28T05:00:55Z","updated_at":"2026-11-02T14:43:26.967621Z"}],"nvd":[{"id":"CVE-2014-4911","description":"The ssl_decrypt_buf function in library/ssl_tls.c in PolarSSL before 1.2.11 and 1.3.x before 1.3.8 allows remote attackers to cause a denial of service (crash) via vectors related to the GCM ciphersuites, as demonstrated using the Codenomicon Defensics toolkit.","status":"published","published":"2014-07-22T14:55:09.817Z","modified":"2026-06-17T00:10:46.93Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"DLA-36-1","title":"polarssl - security update","status":"published","published":"2014-08-11T00:00:00Z","modified":"2026-03-09T01:20:27.132047Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-2981-1","title":"polarssl - security update","status":"published","published":"2014-07-18T00:00:00Z","modified":"2026-03-09T01:22:14.357625Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0315","title":"Updated polarssl packages fix security vulnerability","description":"A flaw was discovered in PolarSSL, a lightweight crypto and SSL/TLS library,\nwhich can be exploited by a remote unauthenticated attacker to mount a denial\nof service against PolarSSL servers that offer GCM ciphersuites. Potentially\nclients are affected too if a malicious server decides to execute the denial\nof service attack against its clients (CVE-2014-4911).\n\nThe pdns package has been rebuilt against the updated polarssl library.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:33.495764735Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}