CVE-2015-5291

NameCVE-2015-5291
DescriptionHeap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message. NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-331-1, DSA-3468-1
Debian Bugs801413

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mbedtls (PTS)buster2.16.0-1fixed
buster (security)2.16.9-0~deb10u1fixed
bullseye2.16.9-0.1fixed
bookworm2.28.3-1fixed
trixie2.28.7-1fixed
sid2.28.7-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mbedtlssource(unstable)(not affected)
polarsslsourceexperimental1.3.14-0.1
polarsslsourcesqueeze1.2.9-1~deb6u5DLA-331-1
polarsslsourcewheezy1.2.9-1~deb7u6DSA-3468-1
polarsslsourcejessie1.3.9-2.1+deb8u1DSA-3468-1
polarsslsource(unstable)(unfixed)801413

Notes

- mbedtls <not-affected> (Fixed before the initial release to Debian)
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01

Search for package or bug name: Reporting problems