CVE-2013-2220

2022-10-0316:14:59

Debian Security Bug Tracker

security-tracker.debian.org

buffer overflow

radius extension

php

denial of service

arbitrary code

remote attackers

vendor specific attributes

vsa length

unix

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.02 Low

EPSS

Percentile

88.8%

JSON

Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.

OSVersionArchitecturePackageVersionFilename
Debian11allphp-radius< 1.2.5-2.4php-radius_1.2.5-2.4_all.deb
Debian10allphp-radius< 1.2.5-2.4php-radius_1.2.5-2.4_all.deb