PT-2017-15534 · Arm+2 · Mbed Tls+2

Publicado 2015-12-04 · Atualizado 2026-06-05 · CVE-2017-2784

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mbed TLS versions prior to 1.3.19 mbed TLS versions 2.x prior to 2.1.7 mbed TLS versions 2.4.x prior to 2.4.2

Description A specially crafted x509 certificate can cause an invalid free of a stack pointer when parsed by the mbed TLS library, potentially leading to remote code execution. An attacker can exploit this issue by delivering malicious x509 certificates to vulnerable applications, either as a client or a server on a network.

Recommendations For mbed TLS versions prior to 1.3.19, update to version 1.3.19 or later. For mbed TLS versions 2.x prior to 2.1.7, update to version 2.1.7 or later. For mbed TLS versions 2.4.x prior to 2.4.2, update to version 2.4.2 or later.

Exploit

Correção

RCE

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2015-2061

ALT-PU-2017-1347

CVE-2017-2784

MGASA-2017-0094

OPENSUSE-SU-2017:0790-1

OPENSUSE-SU-2017:0792-1

OPENSUSE-SU-2017_0790-1

OPENSUSE-SU-2024:11043-1

Produtos afetados

Alt Linux

Suse

Mbed Tls

Referências · 29

• 🔥 http://talosintelligence.com/reports/TALOS-2017-0274 · Exploit
• https://lists.opensuse.org/archives/list/[e-mail]/thread/FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ/#FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ · Nota
• https://cve.org/CVERecord?id=CVE-2017-2784 · Nota de Segurança
• https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-2784 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2017:0790-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2784 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2784 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-2784 · Nota
• https://security.alpinelinux.org/vuln/CVE-2017-2784 · Nota
• https://advisories.mageia.org/MGASA-2017-0094.html · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2017:0792-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2784 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11043-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-0488 · Nota