CVE-2014-3158
CVE-2014-3158
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."
EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
ppp Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.6-3
Update to 2.4.6-3
ppp Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.6-3
Update to 2.4.6-3
ppp Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.6-3
Update to 2.4.6-3
ppp Ubuntu:14.04:LTS
- Versions
- 2.4.5-5.1ubuntu2
- Affected ranges
- ECOSYSTEM: < 2.4.5-5.1ubuntu2.1
Update to 2.4.5-5.1ubuntu2.1
Original sources
- http://www.ubuntu.com/usn/USN-2429-1
- http://marc.info/?l=linux-ppp&m=140764978420764
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:135
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1128748
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136932.html
- http://www.debian.org/security/2014/dsa-3079
- http://advisories.mageia.org/MGASA-2014-0368.html
- https://github.com/paulusmack/ppp/commit/7658e8257183f062dc01f87969c140707c7e52cb
- https://nvd.nist.gov/vuln/detail/CVE-2014-3158