The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nettle | Aug 30, 2017 | Feb 23, 2016 |
| Debian | — | Upgrade nettle | Jul 30, 2024 | Feb 23, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade nettleUpgrade nettle-devel | Nov 30, 2017 | Feb 23, 2016 |
| Oracle_linux | — | Upgrade nettleUpgrade nettle-devel | Nov 9, 2016 | Feb 23, 2016 |
| Redhat_linux | — | Upgrade nettleUpgrade nettle-develUpgrade nettle-debuginfo | Nov 4, 2016 | Feb 23, 2016 |
| Suse | — | Upgrade libnettle6Upgrade libnettle6-32bitUpgrade libnettle-develUpgrade libhogweed4Upgrade libhogweed2Upgrade libhogweed4-32bitUpgrade libnettle4-32bitUpgrade libhogweed2-32bitUpgrade libnettle4 | Feb 23, 2016 | Feb 23, 2016 |
| Ubuntu | — | Upgrade libnettle4Upgrade libnettle6 | Feb 15, 2016 | Feb 15, 2016 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub