CVE-2015-5316

Publication date 10 November 2015

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.9 · Medium

Score breakdown

Description

The eap_pwd_perform_confirm_exchange function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6, when EAP-pwd is enabled in a network configuration profile, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an EAP-pwd Confirm message followed by the Identity exchange.

Read the notes from the security team

Status

Package Ubuntu Release Status
wpa 15.10 wily
Fixed 2.4-0ubuntu3.2
15.04 vivid
Not affected
14.04 LTS trusty
Not affected
12.04 LTS precise Not in release
wpasupplicant 15.10 wily Not in release
15.04 vivid Not in release
14.04 LTS trusty Not in release
12.04 LTS precise
Not affected

Notes

mdeslaur

looks like it was introduced by 1f1fe195cd8907badca6d4ee17e5fa638b6f83db, so only wily+

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.9 · Medium

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-2808-1
    • wpa_supplicant and hostapd vulnerabilities
    • 10 November 2015

Other references

Access our resources on patching vulnerabilities