CVE-2017-18187

In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.

USN-4267-1 — mbedtls vulnerabilities

Affected: Ubuntu:16.04:LTS: mbedtls

It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by an attacked to execute arbitrary code or cause a denial of service. (CVE-2017-18187)

It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. (CVE-2018-0487)

It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. (CVE-2018-0488)

It was discovered that mbedtls has a vulnerability that allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. (CVE-2018-0497)

It was discovered that mbedtls has a vulnerability that allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack. (CVE-2018-0498)

Most recent entries from all

CVE-2017-18187

USN-4267-1 — mbedtls vulnerabilities