CVE-2015-4142

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-06-15 · updated 2026-06-17
Weakness: CWE-119

Description

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

Affected products

Opensuse: 13.1, 13.2
RedHat Enterprise Linux Desktop: 6.0
RedHat Enterprise Linux Hpc Node: 6.0
RedHat Enterprise Linux Server: 6.0
RedHat Enterprise Linux Workstation: 6.0
w1.fi hostapd: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 1.0, 1.1 (+5)
Canonical Ltd. wpa_supplicant: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 1.0, 1.1 (+5)

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171401.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172608.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172655.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html
http://rhn.redhat.com/errata/RHSA-2015-1090.html
http://rhn.redhat.com/errata/RHSA-2015-1439.html
http://seclists.org/fulldisclosure/2022/May/34
http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt
http://www.debian.org/security/2015/dsa-3397
http://www.openwall.com/lists/oss-security/2015/05/09/5
http://www.openwall.com/lists/oss-security/2015/05/31/6
http://www.securitytracker.com/id/1032625

Get alerted when CVE-2015-4142 or the next vulnerability affects your stack