DEBIAN-CVE-2025-47917
- Source
- https://security-tracker.debian.org/tracker/CVE-2025-47917
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-47917.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-47917
- Upstream
- Downstream
- Published
- 2025-07-20T19:15:23Z
- Modified
- 2026-09-01T16:06:18Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation. The function mbedtls_x509_string_to_names() takes a head argument that is documented as an output argument. The documentation does not suggest that the function will free that pointer; however, the function does call mbedtls_asn1_free_named_data_list() on that argument, which performs a deep free(). As a result, application code that uses this function (relying only on documented behavior) is likely to still hold pointers to the memory blocks that were freed, resulting in a high risk of use-after-free or double-free. In particular, the two sample programs x509/cert_write and x509/cert_req are affected (use-after-free if the san string contains more than one DN).
- References
Affected packages
Debian:12 / mbedtls
Package
- Name
- mbedtls
- Purl
- pkg:deb/debian/mbedtls?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:13 / mbedtls
Package
- Name
- mbedtls
- Purl
- pkg:deb/debian/mbedtls?arch=source&distro=trixie
Debian:14 / mbedtls
Package
- Name
- mbedtls
- Purl
- pkg:deb/debian/mbedtls?arch=source&distro=forky