https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:20:29 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-09513 bdu:2025-09513 https://cve.radiocsirt.org/vuln/bdu:2025-09513 https://cve.radiocsirt.org/vuln/euvd-2026-257954 EUVD-2026-257954 https://cve.radiocsirt.org/vuln/euvd-2026-257954 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47917 <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-47917 https://cve.radiocsirt.org/vuln/ghsa-7xcg-xp2h-m42v <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> https://cve.radiocsirt.org/vuln/ghsa-7xcg-xp2h-m42v https://cve.radiocsirt.org/vuln/msrc_cve-2025-47917 msrc_CVE-2025-47917 https://cve.radiocsirt.org/vuln/msrc_cve-2025-47917 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21144-1 <p>Security update for mbedtls</p> <p>Security update for mbedtls</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21144-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47917 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mbedtls, Ubuntu:Pro:18.04:LTS: mbedtls, Ubuntu:Pro:20.04:LTS: mbedtls, Ubuntu:Pro:22.04:LTS: mbedtls, Ubuntu:Pro:24.04:LTS: mbedtls, Ubuntu:25.10: mbedtls</p> <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: mbedtls, Ubuntu:Pro:18.04:LTS: mbedtls, Ubuntu:Pro:20.04:LTS: mbedtls, Ubuntu:Pro:22.04:LTS: mbedtls, Ubuntu:Pro:24.04:LTS: mbedtls, Ubuntu:25.10: mbedtls</p> <p>Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47917