CVE-2015-8805

Published: Feb 23, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.

Affected (6)

Products: Nettle Project: Nettle · Canonical: Ubuntu Linux · Opensuse: Leap, Opensuse

1 product

1 product

2 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nettle Project Nettle	Up to 3.1.1

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Related CWEs

References (20)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2016-2582.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/02/02/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/02/03/1

Source: cve@mitre.org

http://www.securityfocus.com/bid/84272

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2897-1

Source: cve@mitre.org

https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html

Source: cve@mitre.org

https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d

Source: cve@mitre.org

Patch

http://lists.opensuse.org/opensuse-updates/2016-02/msg00091.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2016-02/msg00093.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2016-02/msg00100.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-2582.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/02/02/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2016/02/03/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/84272

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2897-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.