CVE-2015-5315

The eappwdprocess function in eappeer/eappwd.c in wpasupplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service process...

CVE-2015-5316: NULL Pointer Dereference

The eappwdperformconfirmexchange function in eappeer/eappwd.c in wpasupplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via an EAP-pwd Confirm message followed by the...

PT-2018-4399

Name of the Vulnerable Software and Affected Versions wpa supplicant versions 2.x before 2.6 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending an EAP-pwd Confirm message followed by the Identity exchange when EAP-pwd is enabled. Th...