CVE-2017-2784 Memory corruption in mbed TLS

What is CVE-2017-2784?

CVE-2017-2784 is a high-severity memory corruption vulnerability in ARM mbed TLS, published on 20 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2.1.7, and 2.4.x before 2.4.2. A specially crafted x509 certificate, when parsed by mbed TLS library, can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability, an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.

Weakness: CWE-295

Which versions are affected by CVE-2017-2784?

It affects 1 product.

Products include Trustedfirmware Mbed Tls.

How do I fix CVE-2017-2784?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-2784 being exploited?

There is no known exploitation of CVE-2017-2784 in the wild and no public exploit code.

Other vulnerabilities in ARM mbed TLS

• CVE-2026-34875 Memory corruption in n/a Critical 9.8
• CVE-2024-49195 Memory corruption in n/a Critical 9.8
• CVE-2024-45158 Memory corruption in n/a Critical 9.8
• CVE-2024-45159 Auth bypass in n/a Critical 9.8
• CVE-2023-45199 Mbed TLS 3.2.x through 3.4.x before 3.5 has a Buffer Overflow that can lead to remote Code execution. Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2017-2784, DEBIAN-CVE-2017-2784, GHSA-5wj7-rhf5-hqx4, MGASA-2017-0094, UBUNTU-CVE-2017-2784, openSUSE-SU-2017:0790-1 and 1 more.