UBUNTU-CVE-2015-8036

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2015-8036
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-8036.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2015-8036
Upstream
  • CVE-2015-8036
Withdrawn
2025-07-18T16:43:18Z
Published
2015-11-02T19:59:00Z
Modified
2025-07-16T07:33:28.425166Z
Severity
  • Ubuntu - low
Summary
[none]
Details

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.

References

Affected packages

Ubuntu:16.04:LTS / mbedtls

Package

Name
mbedtls
Purl
pkg:deb/ubuntu/mbedtls@2.2.1-2?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.1-2

Affected versions

2.*
2.1.2-1
2.2.0-1
2.2.1-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedcrypto0"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedcrypto0-dbgsym"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedtls-dev"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedtls-doc"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedtls10"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedtls10-dbgsym"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedx509-0"
        },
        {
            "binary_version": "2.2.1-2",
            "binary_name": "libmbedx509-0-dbgsym"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2015/UBUNTU-CVE-2015-8036.json"