[SECURITY] [DLA 331-1] polarssl security update

Package : polarssl
Version : 1.2.9-1~deb6u5
CVE ID : CVE-2015-5291

A flaw was found in PolarSSl and mbed TLS:

When the client creates its ClientHello message, due to insufficient
bounds checking it can overflow the heap-based buffer containing the
message while writing some extensions. Two extensions in particular could
be used by a remote attacker to trigger the overflow: the session ticket
extension and the server name indication (SNI) extension.

Although most of the vulnerable code is not present in the Squeeze
version, this upload contains at least a length check for incoming data.