CVE-2015-8036
Medium
Description
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Polarssl
PublishedNov 2, 2015
First seenNov 2, 2015
How to fix
Update
- trustedfirmware mbed_tls1.3.14, 2.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| polarssl polarssl | v ≤ 1.2.17 | — |
| trustedfirmware mbed_tls | 1.3.0 ≤ v < 1.3.14, 2.0.0 ≤ v < 2.1.2 | 1.3.14, 2.1.2 |
| debian debian_linux | 7.0, 8.0 | — |
| fedoraproject fedora | 21 | — |
| opensuse opensuse | 13.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.