CVE-2026-75883: Heap-based Buffer Overflow

The code in pppd that formats a response to a PEAP Request packet in peapresponse copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacketbuf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wpa_supplicant (UTSA-2024-003818)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-003818 advisory. The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the...

Updated wpa_supplicant packages fix security vulnerabilities

The updated packages fix a security vulnerability: The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eappeapdecrypt...

AZL-35457 CVE-2023-52160 affecting package wpa_supplicant for versions less than 2.10-2

The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be abused to skip Phase 2...

SUSE CVE-2023-52160

The implementation of PEAP in wpasupplicant through 2.10 allows authentication bypass. For a successful attack, wpasupplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be abused to skip Phase 2...

PT-2023-8665 · Google +6 · Android +7

Name of the Vulnerable Software and Affected Versions: wpa supplicant versions through 2.10 Description: The issue is related to the implementation of PEAP in wpa supplicant, which allows authentication bypass. For a successful attack, wpa supplicant must be configured to not verify the network's...

CVE-2009-2505

The Internet Authentication Service IAS in Microsoft Windows Vista SP2 and Server 2008 SP2 does not properly validate MS-CHAP v2 Protected Extensible Authentication Protocol PEAP authentication requests, which allows remote attackers to execute arbitrary code via crafted structures in a malformed...

Microsoft Security Bulletin MS09-071 - Critical Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution (974318)

Microsoft Security Bulletin MS09-071 - Critical Vulnerabilities in Internet Authentication Service Could Allow Remote Code Execution 974318 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...

Microsoft Patches Critical IE, Windows Vulnerabilities

Microsoft today shipped six bulletins with patches for a total of 12 documented security vulnerabilities in a wide range of widely deployed software products. Three of the six bulletins are rated “critical,” Microsoft’s highest severity rating. The most serious issues affect the company’s Interne...