High severity8.1NVD Advisory· Published Apr 20, 2017· Updated Jun 17, 2026
CVE-2017-2784
CVE-2017-2784
Description
An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*range: <=1.3.18
- cpe:2.3:a:trustedfirmware:mbed_tls:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:trustedfirmware:mbed_tls:2.4.0:*:*:*:*:*:*:*
- (no CPE)range: 2.4.0
- osv-coords3 versionspkg:rpm/opensuse/mbedtls-2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/mbedtls-3&distro=openSUSE%20Tumbleweedpkg:rpm/suse/mbedtls&distro=SUSE%20Package%20Hub%2012
< 2.27.0-1.2+ 2 more
- (no CPE)range: < 2.27.0-1.2
- (no CPE)range: < 3.6.6-1.1
- (no CPE)range: < 1.3.19-5.1
Patches
Vulnerability mechanics
References
3- www.talosintelligence.com/reports/TALOS-2017-0274/nvdExploitTechnical DescriptionThird Party AdvisoryVDB Entry
- tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-01nvdMitigationVendor Advisory
- security.gentoo.org/glsa/201706-18nvd
News mentions
0No linked articles in our index yet.