CVE-2019-11555

The EAP-pwd implementation in hostapd EAP server before 2.8 and wpasupplicant EAP peer before 2.8 does not validate fragmentation reassembly state properly for a case where an unexpected fragment could be received. This could result in process termination due to a NULL pointer dereference denial ...

freeradius security update

3.0.13-10 - Fixes two EAP-PWD security issues Resolves: bz1699413 authentication bypass with an invalid curve attack...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 7 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.1 on RHEL 6 security update

An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

wildfly: Race condition on PID file allows for termination of arbitrary processes by local users

A flaw was discovered in wildfly that would allow local users, who are able to execute init.d script, to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root...

wildfly: Race condition on PID file allows for termination of arbitrary processes by local users

A flaw was discovered in wildfly that would allow local users, who are able to execute init.d script, to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2019:1181-1)

This update for freeradius-server fixes the following issues : Security issues fixed : CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points bsc1132549. CVE-2019-11234: Fixed an authentication bypass caused by...

Security update for wpa_supplicant (moderate)

openSUSE Security Update: Security update for wpasupplicant Announcement ID: openSUSE-SU-2019:1345-1 Rating: moderate References: 1104205 1109209 Cross-References: CVE-2018-14526 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has one errata is now available...

Security update for freeradius-server (important)

openSUSE Security Update: Security update for freeradius-server Announcement ID: openSUSE-SU-2019:1346-1 Rating: important References: 1132549 1132664 Cross-References: CVE-2019-11234 CVE-2019-11235 Affected Products: openSUSE Leap 15.0 An update that fixes two vulnerabilities is now available...

Ubuntu: Security Advisory (USN-3969-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

D-Link DWL-2600AP Upgrade Firmware Command Injection

Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Upgrade Firmware Product & Service Introduction: =============================== The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link...

Ubuntu 16.04 LTS / 18.04 LTS : wpa_supplicant and hostapd vulnerability (USN-3969-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3969-1 advisory. It was discovered that wpasupplicant and hostapd incorrectly handled unexpected fragments when using EAP- pwd. A remote attacker could possibly use th...

USN-3969-1: wpa_supplicant and hostapd vulnerability

It was discovered that wpasupplicant and hostapd incorrectly handled unexpected fragments when using EAP-pwd. A remote attacker could possibly use this issue to cause a denial of service...

USN-3969-1 wpa vulnerability

It was discovered that wpasupplicant and hostapd incorrectly handled unexpected fragments when using EAP-pwd. A remote attacker could possibly use this issue to cause a denial of service...

Fedora Update for hostapd FEDORA-2019-f409af9fbe

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

D-Link DWL-2600AP Authenticated OS Command Injection Vulnerability

D-Link DWL-2600AP suffers from an authentication OS command injection vulnerability via the tftp restore functionality. Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Restore Configuration Product & Service Introduction: =============================== The...

D-Link DWL-2600AP Authenticated OS Command Injection

Document Title: =============== D-Link DWL-2600AP - Authenticated OS Command Injection Restore Configuration Product & Service Introduction: =============================== The D-Link DWL-2600AP has a web interface for configuration. You can use any web browser you like to login to the D-Link...

Information Disclosure

EAP is vulnerable to information disclosure attacks. An attacker could manipulate the component, Configuration File Handler with an unknown input which leads to partially modify data and disclosure of information...

Information Disclosure

Red Hat JBoss Enterprise Application Platform is vulnerable to information disclosure. GET request which results in a 302 redirect, and when the request header 'Host' field was not set, the response header field 'Location' contains the internal IP address of the server. A remote attacker could us...

Information Disclosure

admin-cli in Red Hat JBoss Enterprise Application Platform is vulnerable to information disclosure. This vulnerability exists due to EAP feature to download server log files that allows logs to be available via GET requests causing cross-origin attacks. An attacker could trigger the user's browse...