Every CVE Search/ Get API key

CVE-2018-9988

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in...

7.5 HighFix available

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.16%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
CVE-2018-9988
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
CVE-2018-9988
Updated
2026-11-02
EUVDEUVD-2018-21580 No score

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
EUVD-2018-21580
Updated
2026-11-03
GitHub AdvisoriesGHSA-h9j8-4v77-hmr3 7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in...

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
GHSA-h9j8-4v77-hmr3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
CVE-2018-9988
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-9988 7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
DEBIAN-CVE-2018-9988
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-9988 7.5

ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input.

Record
UBUNTU-CVE-2018-9988
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2018-0253 No score

Updated mbedtls packages fix security issues

CVE-2018-9988: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input. CVE-2018-9989: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input.

Record
MGASA-2018-0253
Updated
2026-11-02
OSVopenSUSE-SU-2018:1039-1 No score

Security update for mbedtls

This update for mbedtls fixes the following issues:

Security issues fixed:

  • CVE-2018-9988: Fixed buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input (boo#1089022).
  • CVE-2018-9989: Fixed buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input (boo#1089021).
Record
openSUSE-SU-2018:1039-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:1041-1 No score

Security update for mbedtls

This update for mbedtls fixes the following issues:

Security issues fixed:

  • CVE-2018-9988: Fixed buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input (boo#1089022).
  • CVE-2018-9989: Fixed buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input (boo#1089021).
Record
openSUSE-SU-2018:1041-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mbedtls
Debian:12
 before 2.8.0-1
2.8.0-1
mbedtls
Debian:13
 before 2.8.0-1
2.8.0-1
mbedtls
Debian:14
 before 2.8.0-1
2.8.0-1
polarssl
Debian:8
 before 1.3.9-2.1+deb8u4, plus listed versions
1.3.9-2.11.3.9-2.1+deb8u11.3.9-2.1+deb8u21.3.9-2.1+deb8u3
1.3.9-2.1+deb8u4
mbedtls
Debian:9
 before 2.4.2-1+deb9u4, plus listed versions
2.4.2-12.4.2-1+deb9u12.4.2-1+deb9u1~bpo8+12.4.2-1+deb9u22.4.2-1+deb9u3
2.4.2-1+deb9u4
bctoolbox
Mageia:6
 before 0.2.0-4.2.mga6
0.2.0-4.2.mga6
hiawatha
Mageia:6
 before 10.4-1.2.mga6
10.4-1.2.mga6
mbedtls
Mageia:6
 before 2.7.3-1.mga6
2.7.3-1.mga6
shadowsocks-libev
Mageia:6
 before 3.1.0-1.2.mga6
3.1.0-1.2.mga6
dolphin-emu
Mageia:6
 before 5.0-5.2.mga6.tainted
5.0-5.2.mga6.tainted
mbedtls
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3
 None known
mbedtls
SUSE:Package Hub 12
 before 1.3.19-14.1
1.3.19-14.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-9988 is a high vulnerability (CVSS 7.5) in Arm Mbed Tls, published April 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in mbedtls 2.8.0-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open