NVD

Id
28852  
Name
CVE-2015-8803  
Description
The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-02-23  
Modified Date
2016-12-05  
Seq
2015-8803  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
151959 28852 CVE-2015-8803 FEDORA-2016-89968f88d2  View
151960 28852 CVE-2015-8803 FEDORA-2016-aa00f0631d  View
151961 28852 CVE-2015-8803 FEDORA-2016-8ee88aee21  View
151962 28852 CVE-2015-8803 openSUSE-SU-2016:0475  View
151963 28852 CVE-2015-8803 openSUSE-SU-2016:0477  View
151964 28852 CVE-2015-8803 openSUSE-SU-2016:0486  View
151965 28852 CVE-2015-8803 [oss-security] 20160202 Miscomputations of elliptic curve scalar multiplications in Nettle  View
151966 28852 CVE-2015-8803 [oss-security] 20160202 Re: Miscomputations of elliptic curve scalar multiplications in Nettle  View
151967 28852 CVE-2015-8803 USN-2897-1  View
151968 28852 CVE-2015-8803 https://blog.fuzzing-project.org/38-Miscomputations-of-elliptic-curve-scalar-multiplications-in-Nettle.html  View
151969 28852 CVE-2015-8803 https://git.lysator.liu.se/nettle/nettle/commit/c71d2c9d20eeebb985e3872e4550137209e3ce4d  View
151970 28852 CVE-2015-8803 [info-gnu] 20160128 ANNOUNCE: Nettle-3.2  View
151971 28852 CVE-2015-8803 [nettle-bugs] 20151212 secp256 calculation bug (already fixed)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11661 JVNDB-2015-006981 Nettle の ecc-256.c の ecc_256_modp 関数における脆弱性 Nettle の ecc-256.c の ecc_256_modp 関数は、P-256 NIST 楕円曲線の実装においてキャリー伝播 (carry propagation) を適切に処理せず、不正な出力を引き起こすため、不特定の影響を受ける脆弱性が存在します。 CVE-2015-8803 86028 CVE-2015-8803 28852 7.5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006981.html 2015-12-10 2016-03-14 View