CVE-2013-5914

medium

Published 2013-10-26 · Modified 2026-04-29

CVSS v3

—

CVSS v2

6.8

VIR risk

6.8

Description

Buffer overflow in the ssl_read_record function in ssl_tls.c in PolarSSL before 1.1.8, when using TLS 1.1, might allow remote attackers to execute arbitrary code via a long packet.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04

Application impact

Vendor	Product	Versions
polarssl	polarssl	`{"endIncluding":"1.1.7"}`
polarssl	polarssl	`1.0.0`
polarssl	polarssl	`1.1.0`
polarssl	polarssl	`1.1.1`
polarssl	polarssl	`1.1.2`
polarssl	polarssl	`1.1.3`
polarssl	polarssl	`1.1.4`
polarssl	polarssl	`1.1.5`
polarssl	polarssl	`1.1.6`

References

http://www.debian.org/security/2013/dsa-2782
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04
http://www.debian.org/security/2013/dsa-2782
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-04

CWEs

CWE-119

Verify integrity in audit chain (admin only). AS-IS.