MGASA-2016-0054

    Dashboard / Vulnerabilities / MGASA-2016-0054

    MGASA-2016-0054

    Published: 9 Feb 2016Last Modified: 16 Apr 2026

    Summary: Updated mbedtls/hiawatha/belle-sip/linphone/pdns packages fix security vulnerability

    Details: Note: this package was called polarssl, but is now called mbed tls. The PolarSSL software is now called mbed TLS. Heap-based buffer overflow in mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message (CVE-2015-5291). Heap-based buffer overflow in mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session (CVE-2015-8036). The mbedtls package has been updated to version 1.3.16, which contains several other bug fixes, security fixes, and security enhancements. The hiawatha package, which uses the polarssl/mbedtls library, has been updated to version 9.13 for improved compatibility. The belle-sip library package has been updated to version 1.4.2 for improved compatibility and the linphone package has been rebuilt against mbedtls. The pdns package has also been rebuilt against mbedtls.

    References: https://advisories.mageia.org/MGASA-2016-0054.html, https://bugs.mageia.org/show_bug.cgi?id=17187, https://tls.mbed.org/tech-updates/releases/mbedtls-1.3.10-released, https://tls.mbed.org/tech-updates/releases/mbedtls-1.3.11-released, https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released, https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released, https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.2-and-1.3.14-and-polarssl-1.2.17-released, https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.0-2.1.3-1.3.15-and-polarssl.1.2.18-released, https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released, https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01, https://lists.fedoraproject.org/pipermail/package-announce/2015-June/159916.html, https://lists.fedoraproject.org/pipermail/package-announce/2015-October/169765.html, https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175762.html

    Affected packages

    Package

    Name: mbedtls

    Purl: pkg:rpm/mageia/mbedtls?arch=source&distro=mageia-5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.3.16-1.mga5

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2016-0054 | CVE-DB