CVE-2015-8036
published 2015-11-02CVE-2015-8036: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service…
PriorityP432medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
2.87%
85.0th percentile
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | mbedtls | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mbed | mbedtls | >= 0 < 2.2.1-2 | 2.2.1-2 |
| opensuse | leap | — | — |
| opensuse | opensuse | — | — |
| polarssl | polarssl | <= 1.2.17 | — |
| polarssl | polarssl | >= 1.0.0 < 1.2.17 | 1.2.17 |
| trustedfirmware | mbed_tls | >= 1.3.0 < 1.3.14 | 1.3.14 |
| trustedfirmware | mbed_tls | >= 2.0.0 < 2.1.2 | 2.1.2 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2015-5291: mbedtls - Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (forme...
vendor_debian·2015·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291: mbedtls - Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (forme...
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2015-8036: mbedtls - Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3....
vendor_debian·2015·CVSS 6.8
CVE-2015-8036 [MEDIUM] CVE-2015-8036: mbedtls - Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3....
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-hhcq-g9mx-qpfg: Heap-based buffer overflow in PolarSSL 1
ghsa_unreviewed·2022-05-14·CVSS 6.8
CVE-2015-5291 [MEDIUM] CWE-119 GHSA-hhcq-g9mx-qpfg: Heap-based buffer overflow in PolarSSL 1
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
GHSA
GHSA-h6fm-cj44-vv3x: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1
ghsa_unreviewed·2022-05-14·CVSS 6.8
CVE-2015-8036 [MEDIUM] CWE-119 GHSA-h6fm-cj44-vv3x: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
OSV
CVE-2015-8036: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1
osv·2015-11-02·CVSS 6.8
CVE-2015-8036 [MEDIUM] CVE-2015-8036: Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
OSV
CVE-2015-5291: Heap-based buffer overflow in PolarSSL 1
osv·2015-11-02·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291: Heap-based buffer overflow in PolarSSL 1
Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI
bugzilla·2015-10-09·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI
A flaw was found in PolarSSl and mbed TLS:
When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension.
This issue is fixed in PolarSSL 1.2.17 and up, mbed TLS 1.3.14 and up, mbed TLS 2.1.2 and up.
External References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01
Discussion:
Created mbedtls tracking bugs for this issue:
Affects: fedora-all [bug 12
Bugzilla
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
bugzilla·2015-10-09·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOT
Bugzilla
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
bugzilla·2015-10-09·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOT
Bugzilla
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [epel-all]
bugzilla·2015-10-09·CVSS 6.8
CVE-2015-5291 [MEDIUM] CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [epel-all]
CVE-2015-5291 CVE-2015-8036 polarssl: mbedtls: crash or remote code execution on clients using session tickets or SNI [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.htmlhttp://lists.opensuse.org/opensuse-updates/2016-08/msg00009.htmlhttp://www.debian.org/security/2016/dsa-3468https://guidovranken.files.wordpress.com/2015/10/cve-2015-5291.pdfhttps://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.htmlhttp://lists.opensuse.org/opensuse-updates/2016-08/msg00009.htmlhttp://www.debian.org/security/2016/dsa-3468https://guidovranken.files.wordpress.com/2015/10/cve-2015-5291.pdfhttps://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01
2015-11-02
Published