what you don't know can hurt you

Gentoo Linux Security Advisory 201804-19

Gentoo Linux Security Advisory 201804-19
Posted Apr 23, 2018
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201804-19 - Multiple vulnerabilities have been found in mbed TLS, the worst of which could allow remote attackers to execute arbitrary code. Versions less than 2.7.2 are affected.

tags | advisory, remote, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2017-18187, CVE-2018-0487, CVE-2018-0488
MD5 | 7915335f91ab13bb374a62cf8258bf56

Gentoo Linux Security Advisory 201804-19

Change Mirror Download
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201804-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: mbed TLS: Multiple vulnerabilites
Date: April 22, 2018
Bugs: #647800
ID: 201804-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in mbed TLS, the worst of
which could allow remote attackers to execute arbitrary code.

Background
==========

mbed TLS (previously PolarSSL) is an aeasy to understand, use,
integrate and expanda implementation of the TLS and SSL protocols and
the respective cryptographic algorithms and support code required.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/mbedtls < 2.7.2 >= 2.7.2

Description
===========

Multiple vulnerabilities have been discovered in mbed TLS. Please
review the CVE identifiers referenced below for details.

Impact
======

A remote attacker, through multiple vectors, could possibly execute
arbitrary code with the privileges of the process or cause a Denial of
Service condition.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All mbed TLS users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/mbedtls-2.7.2"

References
==========

[ 1 ] CVE-2017-18187
https://nvd.nist.gov/vuln/detail/CVE-2017-18187
[ 2 ] CVE-2018-0487
https://nvd.nist.gov/vuln/detail/CVE-2018-0487
[ 3 ] CVE-2018-0488
https://nvd.nist.gov/vuln/detail/CVE-2018-0488

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201804-19

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close