{"affected":[{"ecosystem_specific":{"binaries":[{"libmbedtls9":"1.3.19-5.1","mbedtls-devel":"1.3.19-5.1"}]},"package":{"ecosystem":"SUSE:Package Hub 12","name":"mbedtls","purl":"pkg:rpm/suse/mbedtls&distro=SUSE%20Package%20Hub%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.3.19-5.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update to mbedtls 1.3.19 fixes security issues and bugs.\n\nThe following vulnerability was fixed:\n\nCVE-2017-2784: A remote user could have used a specially crafted certificate to cause\n               mbedtls to free a buffer allocated on the stack when verifying the validity\n               of public key with a secp224k1 curve, which could have allowed remote\n               code execution on some platforms (boo#1029017)\n\nThe following non-security changes are included:\n\n- Add checks to prevent signature forgeries for very large messages while using RSA through\n  the PK module in 64-bit systems.\n- Fixed potential livelock during the parsing of a CRL in PEM format\n","id":"openSUSE-SU-2017:0792-1","modified":"2017-03-22T10:02:23Z","published":"2017-03-22T10:02:23Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ/#FAMN75AB4YE4LABPQEYS2NAM6F32VCFZ"},{"type":"REPORT","url":"https://bugzilla.suse.com/1029017"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-2784"}],"related":["CVE-2017-2784"],"summary":"Security update for mbedtls","upstream":["CVE-2017-2784"]}