Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2014-7912

HistoryJul 30, 2015 - 12:59 a.m.

CVE-2014-7912

2015-07-3000:59:00

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.012

Percentile

85.4%

JSON

The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a large length value of an option in a DHCPACK message.

OSVersionArchitecturePackageVersionFilename
Debian12alldhcpcd5< 6.9.1-1dhcpcd5_6.9.1-1_all.deb
Debian11alldhcpcd5< 6.9.1-1dhcpcd5_6.9.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dhcpcd5	< 6.9.1-1	dhcpcd5_6.9.1-1_all.deb
Debian	11	all	dhcpcd5	< 6.9.1-1	dhcpcd5_6.9.1-1_all.deb

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.012

Percentile

85.4%

JSON

Related for DEBIANCVE:CVE-2014-7912