CVE-2018-11574
Description
Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files. Configurations that use the refuse-app option are unaffected.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.406
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.5-5.1ubuntu2.3_i386.deb | Linux |
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.5-5.1ubuntu2.3_amd64.deb | Linux |
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.7-2+2ubuntu1.1_i386.deb | Linux |
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.7-2+2ubuntu1.1_amd64.deb | Linux |
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.7-1+2ubuntu1.16.04.1_i386.deb | Linux |
| Point-to-Point Protocol (PPP) (USN-3810-1) ppp_2.4.7-1+2ubuntu1.16.04.1_amd64.deb | Linux |
| Improper Input Validation Vulnerability (CVE-2018-11574) | NCM |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234