CVE-2015-8041

Publication date 9 November 2015

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or infinite loop) via a large payload length field value in an (1) WPS or (2) P2P NFC NDEF record, which triggers an out-of-bounds read.

Read the notes from the security team

Status

Package Ubuntu Release Status
hostapd 16.04 LTS xenial Not in release
15.10 wily Not in release
15.04 vivid Not in release
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected
wpa 16.04 LTS xenial
Fixed 2.4-0ubuntu5
15.10 wily Ignored end of life
15.04 vivid
Not affected
14.04 LTS trusty
Not affected
12.04 LTS precise Not in release
wpasupplicant 16.04 LTS xenial Not in release
15.10 wily Not in release
15.04 vivid Not in release
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected

Notes

tyhicks

CONFIG_WPS_NFC is not set in Vivid and older builds of wpa CONFIG_WPS_NFS is not set in wpasupplicant or hostapd builds

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
wpa