{"id":"CVE-2015-1182","aliases":["DEBIAN-CVE-2015-1182","DLA-144-1","DSA-3136-1","EUVD-2015-1324","GHSA-8g33-q77c-23f6","MGASA-2015-0055","openSUSE-SU-2024:10088-1","openSUSE-SU-2024:12903-1","openSUSE-SU-2026:11119-1"],"status":"published","title":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x...","description":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03099,"percentile":0.87826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-01-24T00:00:00Z","modified":"2026-06-26T08:15:07Z","fixes":[{"ecosystem":"Debian:6.0","package":"polarssl","fixed_in":["1.2.9-1~deb6u4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"polarssl","fixed_in":["1.2.9-1~deb7u5"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"polarssl","fixed_in":["1.3.9-1.1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb6u4"}]}],"versions":["0.12.1-1","0.12.1-1squeeze1","0.14.3-1","1.0.0-1","1.0.0-2","1.0.0-2+s390x","1.0.0-3","1.1.0-1","1.1.1-1","1.1.2-1","1.1.3-1","1.1.4-1","1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1","1.2.9-1~deb6u2","1.2.9-1~deb6u3"]},{"source":"osv","ecosystem":"Debian:7","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb7u5"}]}],"versions":["1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1","1.2.9-1~deb6u2","1.2.9-1~deb6u3","1.2.9-1~deb6u4","1.2.9-1~deb6u5","1.2.9-1~deb7u1","1.2.9-1~deb7u2","1.2.9-1~deb7u3","1.2.9-1~deb7u4"]},{"source":"osv","ecosystem":"Mageia:4","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9-1.1.mga4"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.3-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1.1"}]}],"bundled":14}],"products":[{"vendor":"opensuse","product":"opensuse"},{"vendor":"polarssl","product":"polarssl"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148829.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://secunia.com/advisories/62270","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148903.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-02/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201801-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://secunia.com/advisories/62610","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3136","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1182"},{"url":"https://github.com/advisories/GHSA-8g33-q77c-23f6"},{"url":"https://advisories.mageia.org/MGASA-2015-0055.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15137","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3136","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46393","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1182","description":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.","status":"published","published":"2015-01-27T15:00:00Z","modified":"2024-08-06T04:33:20.872Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1324","description":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.","status":"published","published":"2015-01-27T15:00:00Z","modified":"2024-08-06T04:33:20Z","updated_at":"2026-11-03T02:22:16.581763Z"}],"ghsa":[{"id":"GHSA-8g33-q77c-23f6","title":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x...","description":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.","status":"published","published":"2022-05-14T02:06:32Z","modified":"2023-02-02T05:04:53Z","updated_at":"2026-11-02T14:51:58.811434Z"}],"nvd":[{"id":"CVE-2015-1182","description":"The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.","status":"published","published":"2015-01-27T20:59:14.277Z","modified":"2026-06-17T00:21:55.027Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"DLA-144-1","title":"polarssl - security update","status":"published","published":"2015-01-29T00:00:00Z","modified":"2026-03-09T01:01:14.797019Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3136-1","title":"polarssl - security update","status":"published","published":"2015-01-24T00:00:00Z","modified":"2026-03-09T01:23:06.054144Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0055","title":"Updated polarssl packages fix CVE-2015-1182","description":"Updated polarssl packages fix security vulnerability:\n\nA vulnerability was discovered in PolarSSL in its certificate parser. A remote\nattacker could exploit this flaw using specially crafted certificates to mount\na denial of service against an application linked against the library\n(application crash), or potentially, to execute arbitrary code\n(CVE-2015-1182).\n","status":"published","published":"2015-02-09T21:44:14Z","modified":"2026-04-16T06:23:29.409887142Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10088-1","title":"libmbedcrypto0-2.4.0-1.2 on GA media","description":"These are all security issues fixed in the libmbedcrypto0-2.4.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:34:37.716349Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12903-1","title":"libmbedcrypto7-2.28.3-1.1 on GA media","description":"These are all security issues fixed in the libmbedcrypto7-2.28.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:04.035461Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11119-1","title":"libeverest-3.6.6-1.1 on GA media","description":"These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.625184367Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}