Vulnetix
Try Vulnetix Request Demo
CVE-2015-8036 REJECTED

Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.

EPSS 1.44% · 80.6th percentile

Risk Scores

EPSS Score
1.44%
80.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSmbedtls0, 2.1.2-1, 2.2.0-1

Timeline

References

Open in Interactive Console →