{"id":"CVE-2015-5291","aliases":["DEBIAN-CVE-2015-5291","DLA-331-1","DSA-3468-1","EUVD-2015-5268","GHSA-hhcq-g9mx-qpfg","MGASA-2016-0054","UBUNTU-CVE-2015-5291","openSUSE-SU-2024:10088-1","openSUSE-SU-2024:12903-1","openSUSE-SU-2026:11119-1"],"status":"published","title":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3...","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03646,"percentile":0.89656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-10-22T00:00:00Z","modified":"2026-06-26T08:15:07Z","fixes":[{"ecosystem":"Debian:6.0","package":"polarssl","fixed_in":["1.2.9-1~deb6u5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb6u5"}]}],"versions":["0.12.1-1","0.12.1-1squeeze1","0.14.3-1","1.0.0-1","1.0.0-2","1.0.0-2+s390x","1.0.0-3","1.1.0-1","1.1.1-1","1.1.2-1","1.1.3-1","1.1.4-1","1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1","1.2.9-1~deb6u2","1.2.9-1~deb6u3","1.2.9-1~deb6u4"]},{"source":"osv","ecosystem":"Debian:7","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1~deb7u6"}]}],"versions":["1.1.4-2","1.2.0-1","1.2.2-1","1.2.3-1","1.2.4-1","1.2.5-1","1.2.6-1","1.2.7-1","1.2.8-1","1.2.8-2","1.2.9-1~deb6u1","1.2.9-1~deb6u2","1.2.9-1~deb6u3","1.2.9-1~deb6u4","1.2.9-1~deb6u5","1.2.9-1~deb7u1","1.2.9-1~deb7u2","1.2.9-1~deb7u3","1.2.9-1~deb7u4","1.2.9-1~deb7u5"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"polarssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.9-2.1+deb8u1"}]}],"versions":["1.3.9-2.1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.16-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"hiawatha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.13-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"belle-sip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"linphone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"pdns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.3-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1.1"}]}],"bundled":14}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"polarssl","product":"polarssl"},{"vendor":"trustedfirmware","product":"mbed_tls"}],"references":[{"url":"http://www.debian.org/security/2016/dsa-3468","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory"]},{"url":"https://guidovranken.files.wordpress.com/2015/10/cve-2015-5291.pdf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://guidovranken.wordpress.com/2015/10/07/cve-2015-5291/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169625.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170317.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169765.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2015-01","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201706-18","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00119.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5291"},{"url":"https://guidovranken.wordpress.com/2015/10/07/cve-2015-5291"},{"url":"https://github.com/advisories/GHSA-hhcq-g9mx-qpfg"},{"url":"https://advisories.mageia.org/MGASA-2016-0054.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17187","tags":["report"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-1.3.10-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-1.3.11-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/polarssl-1.2.15-and-mbedtls-1.3.12-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.1-and-1.3.13-and-polarssl-1.2.16-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.2-and-1.3.14-and-polarssl-1.2.17-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.0-2.1.3-1.3.15-and-polarssl.1.2.18-released","tags":["web"]},{"url":"https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.1-2.1.4-1.3.16-and-polarssl.1.2.19-released","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-June/159916.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-October/169765.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2016-January/175762.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-5291","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5291","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-46393","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-5291","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","status":"published","published":"2015-11-02T19:00:00Z","modified":"2024-08-06T06:41:09.53Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5268","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","status":"published","published":"2015-11-02T19:00:00Z","modified":"2024-08-06T06:41:09Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-hhcq-g9mx-qpfg","title":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3...","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","status":"published","published":"2022-05-14T00:58:01Z","modified":"2025-04-12T12:53:40Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:24.215593Z"}],"nvd":[{"id":"CVE-2015-5291","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","status":"published","published":"2015-11-02T19:59:05.123Z","modified":"2026-06-17T00:28:49.777Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:12.30866Z"}],"osv":[{"id":"DLA-331-1","title":"polarssl - security update","status":"published","published":"2015-10-22T00:00:00Z","modified":"2026-03-09T01:22:01.339383Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3468-1","title":"polarssl - security update","status":"published","published":"2016-02-06T00:00:00Z","modified":"2026-03-09T01:22:34.333845Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0054","title":"Updated mbedtls/hiawatha/belle-sip/linphone/pdns packages fix security vulnerability","description":"Note: this package was called polarssl, but is now called mbed tls.  The\nPolarSSL software is now called mbed TLS.\n\nHeap-based buffer overflow in mbed TLS (formerly PolarSSL) 1.3.x before\n1.3.14 allows remote SSL servers to cause a denial of service\n(client crash) and possibly execute arbitrary code via a long hostname to\nthe server name indication (SNI) extension, which is not properly handled\nwhen creating a ClientHello message (CVE-2015-5291).\n\nHeap-based buffer overflow in mbed TLS (formerly PolarSSL) 1.3.x before\n1.3.14 allows remote SSL servers to cause a denial of service\n(client crash) and possibly execute arbitrary code via a long session\nticket name to the session ticket extension, which is not properly\nhandled when creating a ClientHello message to resume a session\n(CVE-2015-8036).\n\nThe mbedtls package has been updated to version 1.3.16, which contains\nseveral other bug fixes, security fixes, and security enhancements.\n\nThe hiawatha package, which uses the polarssl/mbedtls library, has been\nupdated to version 9.13 for improved compatibility.\n\nThe belle-sip library package has been updated to version 1.4.2 for\nimproved compatibility and the linphone package has been rebuilt against\nmbedtls.\n\nThe pdns package has also been rebuilt against mbedtls.\n","status":"published","published":"2016-02-09T13:05:25Z","modified":"2026-04-16T06:25:00.926629513Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10088-1","title":"libmbedcrypto0-2.4.0-1.2 on GA media","description":"These are all security issues fixed in the libmbedcrypto0-2.4.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:34:37.716349Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12903-1","title":"libmbedcrypto7-2.28.3-1.1 on GA media","description":"These are all security issues fixed in the libmbedcrypto7-2.28.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:04.035461Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:11119-1","title":"libeverest-3.6.6-1.1 on GA media","description":"These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-25T00:00:00Z","modified":"2026-06-26T08:15:07.625184367Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"UBUNTU-CVE-2015-5291","description":"Heap-based buffer overflow in PolarSSL 1.x before 1.2.17 and ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long hostname to the server name indication (SNI) extension, which is not properly handled when creating a ClientHello message.  NOTE: this identifier has been SPLIT per ADT3 due to different affected version ranges. See CVE-2015-8036 for the session ticket issue that was introduced in 1.3.0.","status":"withdrawn","published":"2015-11-02T19:59:00Z","modified":"2025-07-16T08:11:36.490034Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}