CVE-2017-2784 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Critical
Remote	Yes
Type	Arbitrary code execution
Description	A security issue has been found in mbed TLS < 2.4.2. If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-198	mbedtls	2.4.0-1	2.4.2-1	Critical	Fixed

Date	Advisory	Group	Package	Severity	Type
20 Mar 2017	ASA-201703-16	AVG-198	mbedtls	Critical	arbitrary code execution

References
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01 http://www.talosintelligence.com/reports/TALOS-2017-0274/