CVE-2017-1000413

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Linaro's open source TEE solution called OP-TEE, version 2.4.0 (and older) is vulnerable a timing attack in the Montgomery parts of libMPA in OP-TEE resulting in a compromised private RSA key.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/OP-TEE/optee_os/blob/2.5.0/CHANGELOG.mdThird Party Advisory
https://github.com/OP-TEE/optee_os/pull/1610Third Party Advisory
https://www.op-tee.org/security-advisories/Vendor Advisory
https://github.com/OP-TEE/optee_os/blob/2.5.0/CHANGELOG.mdThird Party Advisory
https://github.com/OP-TEE/optee_os/pull/1610Third Party Advisory
https://www.op-tee.org/security-advisories/Vendor Advisory

Timeline

Published: Jan 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10004147.5ImpulseAdventure JPEGsnoop version 1.7.5 is vulnerable to a division by zero in the JFIF decode handling resulting denial of service.CVE-2017-10004155.9MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certifi CVE-2017-10004165.3axTLS version 1.5.3 has a coding error in the ASN.1 parser resulting in the year (19)50 of UTCTime being misinterpreted as 2050.CVE-2017-10004175.3MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension)CVE-2017-10004187.8The WildMidi_Open function in WildMIDI since commit d8a466829c67cacbb1700beded25c448d99514e5 allows remote attackers to cause a denial of se CVE-2017-10004197.5phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting CVE-2017-10004207.5Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite CVE-2017-10004219.8Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution CVE-2017-10004228.8Gnome gdk-pixbuf 2.36.8 and older is vulnerable to several integer overflow in the gif_get_lzw function resulting in memory corruption and p CVE-2017-10004239.8b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resu CVE-2017-10004244.3Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loadi CVE-2017-10004256.1Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers t