ELA-1579-1 mbedtls security update

Package	mbedtls
Version	2.16.9-0~deb10u2 (buster)
Related CVEs	CVE-2025-47917 CVE-2025-48965 CVE-2025-52496 CVE-2025-52497

Multiple vulnerabilities have been fixed in mbedtls, a lightweight crypto and SSL/TLS library.

• CVE-2025-47917

  MbedTLS allows use-after-free in certain situations in the correctly developed applications.

• CVE-2025-48965

  The handling of val.p and val.len in mbedtls_asn1_store_named_data was inconsistent and allowed NULL pointer dereference. The fix for this issue depended on fixes for two related issues in the same piece of code, which are now also fixed.

• CVE-2025-52496

  A race condition in AESNI detection could occur if certain compiler optimisations were applied, making it possible to extract an AES key from a multithreaded program or perform a GCM forgery.

• CVE-2025-52497

  In mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, one-byte heap-based buffer underflow could occur.

For Debian 10 buster, these problems have been fixed in version 2.16.9-0~deb10u2.

We recommend that you upgrade your mbedtls packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.