CVE-2022-33279 Stack based buffer overflow in WLAN

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length...

CVE-2022-33279

CVE-2022-33279 describes a stack-based buffer overflow in the WLAN module of Qualcomm devices triggered by an invalid WNM frame length, causing memory corruption. The CVSSv3.1 vector indicates a critical, network-exposed issue with no user interaction and no privileges required. Connected sources...

The vulnerability of Huawei BiSheng-WNM printer’s microprogramming software, related to insufficient input data verification, allows attackers to trigger service failures.

The vulnerability of Huawei BiSheng-WNM printer’s microprogramming software is related to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures using specially created data...

H3C SSL VPN Cross-Site Scripting Vulnerability

H3C SSL VPN is a secure session layer VPN from China's Xinhua San H3C. A cross-site scripting vulnerability exists in H3C SSL VPN 2022-07-10 and prior versions, which can be exploited by remote attackers to allow wnm/login/login.json svpnlang cross-site scripting attacks...

Cross site scripting

H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS...

PT-2022-22816 · H3C · H3C Ssl Vpn

Name of the Vulnerable Software and Affected Versions: H3C SSL VPN versions through 2022-07-10 Description: The issue allows for XSS through the svpnlang cookie in the wnm/login/login.json API endpoint. Recommendations: For versions through 2022-07-10, as a temporary workaround, consider...

SUSE: Security Advisory (SUSE-SU-2016:2305-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-0378

In onWnmFrameReceived of PasspointManager.java, there is a missing permission check. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10...

hostap/wnm-fuzzer: Heap-buffer-overflow in WPA_GET_LE64

Project: git://w1.fi/srv/git/hostap.git Detailed report: https://oss-fuzz.com/testcase?key=5179747476176896 Project: hostap Fuzzer: aflhostapwnm-fuzzer Fuzz target binary: wnm-fuzzer Job Type: aflasanhostap Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60700000045b...

Google Android System Buffer Overflow Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in the wnmparseneighborreportelem of wnmsta.c file in Android. The vulnerability stems from a network system or product performing operation...

Fedora 26 : 1:wpa_supplicant (2017-60bfb576b7) (KRACK)

Fix the for the Key Reinstallation Attacks ========================================== - hostapd: Avoid key reinstallation in FT handshake CVE-2017-13082 - Fix PTK rekeying to generate a new ANonce - Prevent reinstallation of an already in-use group key and extend protection of GTK/IGTK...

Fedora 25 : 1:wpa_supplicant (2017-12e76e8364) (KRACK)

Fix the for the Key Reinstallation Attacks ========================================== - hostapd: Avoid key reinstallation in FT handshake CVE-2017-13082 - Fix PTK rekeying to generate a new ANonce - Prevent reinstallation of an already in-use group key and extend protection of GTK/IGTK...

CVE-2017-13087

A new exploitation technique called key reinstallation attacks KRACK affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key GTK during a Wireles...

[ASA-201710-22] wpa_supplicant: man-in-the-middle

Arch Linux Security Advisory ASA-201710-22 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13087 CVE-2017-13088 Package : wpasupplicant Type : man-in-the-middle...

UBUNTU-CVE-2017-13087

Wi-Fi Protected Access WPA and WPA2 that support 802.11v allows reinstallation of the Group Temporal Key GTK when processing a Wireless Network Management WNM Sleep Mode Response frame, allowing an attacker within radio range to replay frames from access points to clients...

Broadcom: Heap overflow when handling 802.11v WNM Sleep Mode Response(CVE-2017-7065)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. In order to allow clients to configure...

Broadcom 802.11v WNM Sleep Mode Response Heap Overflow Vulnerability

Broadcom suffers from a heap overflow vulnerability when handling 802.11v WNM Sleep Mode Response. Broadcom: Heap overflow when handling 802.11v WNM Sleep Mode Response CVE-2017-7065 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are...

SUSE SLED12 / SLES12 Security Update : wpa_supplicant (SUSE-SU-2016:2305-1)

This update for wpasupplicant fixes the following issues : - CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding. bnc930077 - CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing. bnc930078 - CVE-2015-4143: EAP-pwd missing payload length validation...

FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (976567f6-05c5-11e6-94fa-002590263bf5)

Jouni Malinen reports : wpasupplicant unauthorized WNM Sleep Mode GTK control. 2015-6 - CVE-2015-5310 EAP-pwd missing last fragment length validation. 2015-7 - CVE-2015-5315 EAP-pwd peer error path failure on unexpected Confirm message. 2015-8 - CVE-2015-5316 %NASLMINLEVEL 70300 C Tenable Network...

Code injection

The WNM Sleep Mode code in wpasupplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection MFP was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service ignored packets via a...