CVE-2015-5291 Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client cr...
MediumCVSS 6.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| polarssl | >= 1.0.0, < 1.2.17 | 1.2.17 |
| TrustedFirmware Mbed TLS | >= 1.3.0, < 1.3.14 | 1.3.14 |
| TrustedFirmware Mbed TLS | >= 2.0.0, < 2.1.2 | 2.1.2 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
References
- FEDORA-2015-e22bb33731 mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-30a417bea9 mailing-list third-party-advisory vendor-advisory
- FEDORA-2015-7f939b3af5 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:2257 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:2371 mailing-list third-party-advisory vendor-advisory
- DSA-3468 third-party-advisory vendor-advisory
- guidovranken.files.wordpress.com third-party-advisory
- guidovranken.wordpress.com third-party-advisory
- GLSA-201706-18 third-party-advisory vendor-advisory
- tls.mbed.org vendor-advisory
- Debian Security Tracker CVE-2015-5291 vendor-advisory