USN-4267-1

Dashboard / Vulnerabilities / USN-4267-1

USN-4267-1

Summary: mbedtls vulnerabilities

Details: It was discovered that mbedtls has a bounds-check bypass through an integer overflow that can be used by an attacked to execute arbitrary code or cause a denial of service. (CVE-2017-18187) It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. (CVE-2018-0487) It was discovered that mbedtls has a vulnerability where an attacker could execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. (CVE-2018-0488) It was discovered that mbedtls has a vulnerability that allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. (CVE-2018-0497) It was discovered that mbedtls has a vulnerability that allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack. (CVE-2018-0498)

References: https://ubuntu.com/security/notices/USN-4267-1, https://ubuntu.com/security/CVE-2017-18187, https://ubuntu.com/security/CVE-2018-0487, https://ubuntu.com/security/CVE-2018-0488, https://ubuntu.com/security/CVE-2018-0497, https://ubuntu.com/security/CVE-2018-0498