1. Home
  2. Security Advisories
  3. Gentoo
  4. GLSA-201706-18

[GLSA-201706-18] mbed TLS: Multiple vulnerabilities

Severity High
Affected Packages 1
Unaffected Packages 1
CVEs 3
Info Packages References Vulnerabilities

Multiple vulnerabilities have been found in mbed TLS, the worst of which could lead to the remote execution of arbitrary code.

Background
mbed TLS (previously PolarSSL) is an “easy to understand, use,
integrate and expand” implementation of the TLS and SSL protocols and
the respective cryptographic algorithms and support code required.

Description
Multiple vulnerabilities have been discovered in mbed TLS. Please review
the CVE identifiers referenced below for details.

Impact
A remote attacker could possibly execute arbitrary code with the
privileges of the process, or cause a Denial of Service condition.

Workaround
There is no known workaround at this time.

Resolution
All mbed TLS users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/mbedtls-2.4.2"

Package Affected Version
pkg:ebuild/net-libs/mbedtls?distro=gentoo < 2.4.2
Package Unaffected Version
pkg:ebuild/net-libs/mbedtls?distro=gentoo >= 2.4.2
ID
GLSA-201706-18
Severity
high
URL
https://security.gentoo.org/glsa/201706-18
Published
2017-06-20T00:00:00
(7 years ago)
Modified
2017-06-20T00:00:00
(7 years ago)
Rights
Gentoo Foundation, Inc.
Other Advisories
Source # ID Name URL
CVE CVE-2015-5291 CVE-2015-5291 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5291
CVE CVE-2015-7575 CVE-2015-7575 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7575
CVE CVE-2017-2784 CVE-2017-2784 https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-2784
Bugzilla 562608 Bugzilla #562608 https://bugs.gentoo.org/show_bug.cgi?id=562608
Bugzilla 571102 Bugzilla #571102 https://bugs.gentoo.org/show_bug.cgi?id=571102
Bugzilla 618824 Bugzilla #618824 https://bugs.gentoo.org/show_bug.cgi?id=618824
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:ebuild/net-libs/mbedtls?distro=gentoo net-libs mbedtls < 2.4.2 gentoo
Unaffected pkg:ebuild/net-libs/mbedtls?distro=gentoo net-libs mbedtls >= 2.4.2 gentoo
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date