MGASA-2018-0163: bctoolbox Mageia

CVSS: UnknownPublished
Published 10-03-2018Last modified 16-04-2026
Open JSON

Vulnerability summary

MGASA-2018-0163 is a vulnerability in bctoolbox Mageia with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 2 · Downstream 0
CVE-2018-0487CVE-2018-0488

Timeline

  1. 10-03-2018
    PublishedVulnerability first disclosed.
  2. 16-04-2026
    Last modifiedVulnerability information updated.

Description

Updated mbedtls and related packages fix security vulnerabilities The mbedtls package has been updated to fix several security issues. Fixed a heap corruption issue in the implementation of the truncated HMAC extension. When the truncated HMAC extension is enabled and CBC is used, sending a malicious application packet could be used to selectively corrupt 6 bytes on the peer's heap, which could potentially lead to crash or remote code execution. The issue could be triggered remotely from either side in both TLS and DTLS. (CVE-2018-0488) Fixed a buffer overflow in RSA-PSS verification when the hash was too large for the key size, which could potentially lead to crash or remote code execution. (CVE-2018-0487)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia5 products
  • bctoolbox< 0.2.0-4.1.mga6
  • dolphin-emu< 5.0-5.1.mga6
  • hiawatha< 10.4-1.1.mga6
  • mbedtls< 2.7.0-1.mga6
  • shadowsocks-libev< 3.1.0-1.1.mga6

1 vendor · 5 products

References

4 links