Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM input.
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mbed_tls | Arm | * | 3.6.4 (excluding) |
| Mbedtls | Ubuntu | devel | * |
| Mbedtls | Ubuntu | esm-apps/bionic | * |
| Mbedtls | Ubuntu | esm-apps/focal | * |
| Mbedtls | Ubuntu | esm-apps/jammy | * |
| Mbedtls | Ubuntu | esm-apps/noble | * |
| Mbedtls | Ubuntu | esm-apps/xenial | * |
| Mbedtls | Ubuntu | jammy | * |
| Mbedtls | Ubuntu | noble | * |
| Mbedtls | Ubuntu | oracular | * |
| Mbedtls | Ubuntu | plucky | * |
| Mbedtls | Ubuntu | questing | * |
| Mbedtls | Ubuntu | upstream | * |