Search CVE reports
61 – 70 of 80 results
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | Not affected | Not affected | Not affected | Not affected |
| polarssl | Not in release | Not in release | Not in release | Not in release |
ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | Not affected | Not affected | Not affected | Not affected |
| polarssl | Not in release | Not in release | Not in release | Not in release |
Some fixes available 1 of 2
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an integer overflow in PSK identity parsing in the ssl_parse_client_psk_identity() function in library/ssl_srv.c.
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
| polarssl | — | — | — | Not in release |
Some fixes available 1 of 2
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted...
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
| polarssl | — | — | — | Not in release |
Some fixes available 1 of 2
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS...
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
| polarssl | — | — | — | Not in release |
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
1 affected package
mbedtls
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
ARM mbed TLS before 1.3.21 and 2.x before 2.1.9, if optional authentication is configured, allows remote attackers to bypass peer authentication via an X.509 certificate chain with many intermediates. NOTE: although mbed TLS was...
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | — |
| polarssl | — | — | — | — |
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed...
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
| polarssl | — | — | — | Not in release |
Some fixes available 38 of 44
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol...
12 affected packages
firefox, gnutls26, gnutls28, mbedtls, nss...
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| firefox | — | — | — | Fixed |
| gnutls26 | — | — | — | Not in release |
| gnutls28 | — | — | — | Not affected |
| mbedtls | — | — | — | Not affected |
| nss | — | — | — | Not affected |
| openjdk-6 | — | — | — | Not in release |
| openjdk-7 | — | — | — | Not in release |
| openjdk-8 | — | — | — | Not affected |
| openssl | — | — | — | Not affected |
| openssl098 | — | — | — | Not in release |
| polarssl | — | — | — | Not in release |
| thunderbird | — | — | — | Fixed |
Some fixes available 1 of 3
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session...
2 affected packages
mbedtls, polarssl
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|
| mbedtls | — | — | — | Not affected |
| polarssl | — | — | — | Not in release |