PT-2018-19152 · Arm+1 · Mbed Tls+1

K-Stachowiak · Publicado 2015-12-04 · Atualizado 2026-06-05 · CVE-2018-9989

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mbed TLS versions prior to 2.1.11 mbed TLS versions prior to 2.7.2 mbed TLS versions prior to 2.8.0

Description The issue is related to a buffer over-read in the ssl parse server psk hint() function, which could cause a crash when handling invalid input.

Recommendations For versions prior to 2.1.11, update to version 2.1.11 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.8.0, update to version 2.8.0 or later.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2015-2061

ALT-PU-2018-1495

CVE-2018-9989

DLA-1518-1

DLA-2826-1

MGASA-2018-0253

OPENSUSE-SU-2018:1039-1

OPENSUSE-SU-2018:1041-1

Produtos afetados

Alt Linux

Mbed Tls

Referências · 25

• https://github.com/ARMmbed/mbedtls/commit/5224a7544c95552553e2e6be0b4a789956a6464e · Correção
• https://github.com/ARMmbed/mbedtls/commit/740b218386083dc708ce98ccc94a63a95cd5629e · Correção
• https://osv.dev/vulnerability/MGASA-2018-0253 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-9989 · Aviso do Fabricante
• https://t.me/cveNotify/166265 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-9989 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-9989 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2018:1041-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1089022 · Nota
• https://suse.com/security/cve/CVE-2018-9988 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-9989 · Aviso do Fabricante
• https://bugzilla.suse.com/1089021 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-9989 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1518-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2018:1039-1 · Aviso do Fabricante