CVE:CVE-2015-5291
CNNVD:CNNVD-201511-002
ARM mbed TLS（前称PolarSSL）是英国ARM公司的一款为mbed产品提供安全通讯和加密功能的产品。
ARM PolarSSL和ARM mbed TLS中存在基于堆的缓冲区溢出漏洞，该漏洞源于程序创建ClientHello消息时没有对server name indication(SNI)扩展的主机名执行正确的边界检查。远程攻击者可利用该漏洞造成拒绝服务（客户端崩溃），并执行任意代码。以下产品及版本受到影响：ARM PolarSSL 1.2.17之前1.x版本，ARM mbed TLS 1.3.14之前1.3.x版本，2.1.2之前2.x版本。
solution:Upgrade arm mbed_tls to a higher version than 1.3.14,2.1.2,and avoid the version [1.3.0,1.3.14),[2.0.0,2.1.2); Upgrade polarssl polarssl to a higher version than 1.2.17,and avoid the version [1.0.0,1.2.17); Upgrade debian debian_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade fedoraproject fedora to a higher version than 21,22,23,and avoid the version 21,22,23; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.2,and avoid the version 13.2