Red Hat Security AdvisoryRHSA-2017:1759
freeradius security update
Released 2017-07-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 6) freeradius-2.2.6-7.el6_9
- Red Hat Enterprise Linux Server Optional (v. 6) freeradius-krb5-2.2.6-7.el6_9, freeradius-ldap-2.2.6-7.el6_9, freeradius-mysql-2.2.6-7.el6_9 +5
- Red Hat Enterprise Linux Workstation (v. 6) freeradius-2.2.6-7.el6_9
- Red Hat Enterprise Linux Workstation Optional (v. 6) freeradius-krb5-2.2.6-7.el6_9, freeradius-ldap-2.2.6-7.el6_9, freeradius-mysql-2.2.6-7.el6_9 +5
Fixes 6 records
Priority MEDIUM 52
An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07043 · Published 2017-07-17 · Partial fix CWE-787
Priority LOW 39
An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03381 · Published 2017-07-17 · Partial fix CWE-119
Priority LOW 39
An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03844 · Published 2017-07-17 · Partial fix CWE-125
Priority LOW 39
An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03368 · Published 2017-07-17 · Partial fix CWE-772
Priority LOW 39
An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03368 · Published 2017-07-17 · Partial fix CWE-772
Priority LOW 39
An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03806 · Published 2017-07-17 · Partial fix CWE-119
THREATIST.IORead the docs