openSUSE-SU-2018:0488-1

Import Source

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2018:0488-1

Related

Published

2018-02-20T12:28:29Z

Modified

2018-02-20T12:28:29Z

Summary

Security update for mbedtls

Details

This update for mbedtls fixes the following issues:

CVE-2018-0487: Fixed a buffer overflow in RSASSA-PSS signature verification, which allowed remote attackers to execute arbitrary code or cause a denial of service via a crafted certificate chain. (boo#1080826)
CVE-2018-0488: Fixed a heap vulnerability, which allowed remote attackers to execute arbitrary code or cause a DoS via a crafted application packet when the truncated HMAC extension and CBC are used. (boo#1080828)
CVE-2017-18187: Fixed bound check in sslparseclientpskidentity(), which might lead to an overflow. (boo#1080973)

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.19-11.1

{
    "binaries": [
        {
            "libmbedtls9": "1.3.19-11.1",
            "mbedtls-devel": "1.3.19-11.1"
        }
    ]
}