CVE-2015-1182 Null dereference in n/a
Remote attackers can cause a crash or execute arbitrary code via crafted ASN.1 sequences in certificates due to improper pointer initialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1182?
CVE-2015-1182 is a high-severity vulnerability in Opensuse Opensuse, published on 27 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Which versions are affected by CVE-2015-1182?
It affects 2 products.
Products include Opensuse Opensuse, Polarssl Polarssl.
How do I fix CVE-2015-1182?
Upgrade to a fixed version.
Is CVE-2015-1182 being exploited?
There is no known exploitation of CVE-2015-1182 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DLA-144-1, DSA-3136-1, GHSA-8g33-q77c-23f6, MGASA-2015-0055.