High severity8.1NVD Advisory· Published Apr 20, 2017· Updated May 13, 2026
CVE-2017-2784
CVE-2017-2784
Description
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
Affected products
11cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*range: <=1.3.18
- cpe:2.3:a:arm:mbed_tls:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:arm:mbed_tls:2.4.0:*:*:*:*:*:*:*
- ARM/mbed TLSv5Range: 2.4.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.talosintelligence.com/reports/TALOS-2017-0274/nvdExploitTechnical DescriptionThird Party AdvisoryVDB Entry
- tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01nvdMitigationVendor Advisory
- security.gentoo.org/glsa/201706-18nvd
News mentions
0No linked articles in our index yet.