CVE-2015-4141

2015-06-0100:00:00

ubuntu.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.028 Low

EPSS

Percentile

90.7%

JSON

The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant,
when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote
attackers to cause a denial of service (crash) via a negative chunk length,
which triggers an out-of-bounds read or heap-based buffer overflow.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=787372>

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchwpa< 2.1-0ubuntu1.3UNKNOWN
ubuntu14.10noarchwpa< 2.1-0ubuntu4.2UNKNOWN
ubuntu15.04noarchwpa< 2.1-0ubuntu7.2UNKNOWN
ubuntu15.10noarchwpa< 2.1-0ubuntu8UNKNOWN
ubuntu16.04noarchwpa< 2.1-0ubuntu8UNKNOWN
ubuntu16.10noarchwpa< 2.1-0ubuntu8UNKNOWN
ubuntu17.04noarchwpa< 2.1-0ubuntu8UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	wpa	< 2.1-0ubuntu1.3	UNKNOWN
ubuntu	14.10	noarch	wpa	< 2.1-0ubuntu4.2	UNKNOWN
ubuntu	15.04	noarch	wpa	< 2.1-0ubuntu7.2	UNKNOWN
ubuntu	15.10	noarch	wpa	< 2.1-0ubuntu8	UNKNOWN
ubuntu	16.04	noarch	wpa	< 2.1-0ubuntu8	UNKNOWN
ubuntu	16.10	noarch	wpa	< 2.1-0ubuntu8	UNKNOWN
ubuntu	17.04	noarch	wpa	< 2.1-0ubuntu8	UNKNOWN