Code injection

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4145

CVE-2015-4145 affects hostapd and wpa_supplicant (versions 1.0–2.4). The issue is in the EAP-pwd server/peer handling where a crafted message can cause a denial of service via a memory leak by not validating that a fragment is already being processed and by failing to validate payload length. Pub...

CVE-2015-4146

The CVE-2015-4146 entry affects hostapd and wpa_supplicant (versions 1.0–2.4) via the EAP-pwd peer implementation. The root cause is that L and M flags are not cleared before fragmentation decisions, enabling remote attackers to trigger a denial of service (crash) with a crafted message. Public d...

CVE-2015-4144

CVE-2015-4144 affects hostapd and wpa_supplicant EAP-pwd server/peer implementations (versions 1.0–2.4). The issue is missing validation that a message is long enough to contain the Total-Length field, enabling a remote attacker to trigger a denial of service (crash) via crafted messages. The lin...

CVE-2015-4143

CVE-2015-4143 affects the EAP-pwd server/peer in hostapd and wpa_supplicant (versions 1.0–2.4), enabling remote denial of service via crafted payloads (Commit/Confirm). Root cause: missing payload length validation in EAP-pwd messages, causing out-of-bounds read and crash. Remediation: apply upda...

CVE-2015-4144

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4143

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted 1 Commit or 2 Confirm message payload...

CVE-2015-4143

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service out-of-bounds read and crash via a crafted 1 Commit or 2 Confirm message payload...

CVE-2015-4146

The EAP-pwd peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not clear the L Length and M More flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4146

The EAP-pwd peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not clear the L Length and M More flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4144

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4145

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service memory leak via a crafted message...

CVE-2015-4145

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service memory leak via a crafted message...

openSUSE Security Update : wpa-supplicant (openSUSE-2015-411)

wpasupplicant was updated to fix three security issues. The following vulnerabilities were fixed : CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding boo930077 CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing boo930078 CVE-2015-4143: EAP-pwd missing...

FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (bbc0db92-084c-11e5-bb90-002590263bf5)

Jouni Malinen reports : WPS UPnP vulnerability with HTTP chunked transfer encoding. 2015-2 - CVE-2015-4141 Integer underflow in AP mode WMM Action frame processing. 2015-3 - CVE-2015-4142 EAP-pwd missing payload length validation. 2015-4 - CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-414...

UBUNTU-CVE-2015-4144

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4144

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service crash via a crafted message...

CVE-2015-4145

The EAP-pwd server and peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service memory leak via a crafted message...

CVE-2015-4146

The EAP-pwd peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not clear the L Length and M More flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service crash via a crafted message...

Attachmate Reflection FTP Client PWD Command Buffer Overflow (CVE-2014-5211)

A stack-based buffer overflow vulnerability exists in Attachmate Reflection FTP Client. The vulnerability is caused by insufficient boundary checking while processing PWD command responses. An attacker could exploit this vulnerability by enticing a user to access an FTP server that sends speciall...