Vulnerability Details : CVE-2015-1863
Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2015-1863
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:w1.fi:wpa_supplicant:2.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1863
2.82%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1863
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:A/AC:L/Au:N/C:P/I:P/A:P |
6.5
|
6.4
|
NIST |
CWE ids for CVE-2015-1863
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1863
-
http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19
-
http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt
Third Party Advisory
-
http://www.securitytracker.com/id/1032192
wpa_supplicant P2P SSID Parsing Flaw May Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2015-1090.html
RHSA-2015:1090 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/201606-17
hostapd and wpa_supplicant: Multiple vulnerabilities (GLSA 201606-17) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2015/Apr/82
Full Disclosure: [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflowThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/74296
wpa_supplicant CVE-2015-1863 Heap Buffer Overflow Vulnerability
-
http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00000.html
[security-announce] openSUSE-SU-2015:0813-1: important: Security updateThird Party Advisory
-
http://www.securityfocus.com/archive/1/535353/100/0/threaded
SecurityFocus
-
http://packetstormsecurity.com/files/131598/Android-wpa_supplicant-Heap-Overflow.html
Android wpa_supplicant Heap Overflow ≈ Packet StormThird Party Advisory;VDB Entry
-
http://www.ubuntu.com/usn/USN-2577-1
USN-2577-1: wpa_supplicant vulnerability | Ubuntu security noticesThird Party Advisory
-
http://www.debian.org/security/2015/dsa-3233
Debian -- Security Information -- DSA-3233-1 wpaThird Party Advisory
Jump to