CVE-2015-8036: Buffer Overflow
Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8036?
CVE-2015-8036 is classified as a critical vulnerability due to its potential to cause client crashes and arbitrary code execution.
How do I fix CVE-2015-8036?
To fix CVE-2015-8036, upgrade to mbed TLS version 1.3.14 or higher, or version 2.1.2 or higher.
Which software is affected by CVE-2015-8036?
CVE-2015-8036 affects mbed TLS versions prior to 1.3.14 and 2.x versions prior to 2.1.2, along with older versions of PolarSSL.
Can CVE-2015-8036 be exploited remotely?
Yes, CVE-2015-8036 can be exploited remotely by sending specially crafted session ticket names to the server.
What type of vulnerability is CVE-2015-8036?
CVE-2015-8036 is a heap-based buffer overflow vulnerability.