Все бюллетени/sisyphus_loongarch64/ALT-PU-2026-5885-1
ALT-PU-2026-5885-1

Обновление пакета mbedtls в ветке sisyphus_loongarch64

Версия4.1.0-alt1
Задание#0
Опубликовано2026-04-07
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (6)

CVE-2025-66442
MEDIUM5.1

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

Опубликовано: 2026-04-01Изменено: 2026-04-03
CVSS 3.xСРЕДНЯЯ 5.1
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2026-34874
HIGH7.5

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.

Опубликовано: 2026-04-01Изменено: 2026-04-03
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-34877
CRITICAL9.8

An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

Опубликовано: 2026-04-02Изменено: 2026-04-06
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Ссылки