VDB
GCVE-110-MAGEIA-2018-163
GCVE-110-MAGEIA-2018-163
Advisory Published
The mbedtls package has been updated to fix several security issues.
Fixed a heap corruption issue in the implementation of the truncated HMAC
extension. When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet could be used to selectively corrupt
6 bytes on the peer's heap, which could potentially lead to crash or remote
code execution. The issue could be triggered remotely from either side in
both TLS and DTLS. (CVE-2018-0488)
Fixed a buffer overflow in RSA-PSS verification when the hash was too large
for the key size, which could potentially lead to crash or remote code
execution. (CVE-2018-0487)
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Mageia | mbedtls | 0 (affected), 2.7.0-1.mga6 (unaffected), 0 (affected), 2.7.0-1.mga6 (unaffected) | — |
| Mageia | dolphin-emu | 0 (affected), 5.0-5.1.mga6 (unaffected), 0 (affected), 5.0-5.1.mga6 (unaffected) | — |
| Mageia | hiawatha | 0 (affected), 10.4-1.1.mga6 (unaffected), 0 (affected), 10.4-1.1.mga6 (unaffected) | — |
| Mageia | shadowsocks-libev | 0 (affected), 3.1.0-1.1.mga6 (unaffected), 0 (affected), 3.1.0-1.1.mga6 (unaffected) | — |
| Mageia | bctoolbox | 0 (affected), 0.2.0-4.1.mga6 (unaffected), 0 (affected), 0.2.0-4.1.mga6 (unaffected) | — |
| Mageia | roundcubemail | 0 (affected), 1.3.6-1.2.mga6 (unaffected) | — |
Aliases
References
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.