The RSA-CRT implementation in PolarSSL before 1.2.9 does not properly perform Montgomery multiplication, which might allow remote attackers to conduct a timing side-channel attack and retrieve RSA private keys.

From the PolarSSL Security Advisory 2013-03 advisory:

"A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt() can result in an infinite loop, thus hogging processing power."

A remote attacker could use this flaw to make a TLS/SSL server using PolarSSL consume an excessive amount of CPU.

This issue was corrected in PolarSSL versions 1.1.7 and 1.2.8. (Versions prior to these are affected.)

External References:

https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03

The asn1getsequenceof function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.