[pkg-wpa-devel] Bug#787371: wpa: CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146: EAP-pwd missing payload length validation

[Salvatore Bonaccorso]

Source: wpa
Version: 2.3-1
Severity: important
Tags: security upstream fixed-upstream

Hi,

the following vulnerabilities were published for wpa.

CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146 for the
"EAP-pwd missing payload length validation" issue[0].

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://w1.fi/security/2015-4/eap-pwd-missing-payload-length-validation.txt
    https://marc.info/?l=oss-security&m=143309748931862&w=2
[1] https://security-tracker.debian.org/tracker/CVE-2015-4143
[2] https://security-tracker.debian.org/tracker/CVE-2015-4144
[3] https://security-tracker.debian.org/tracker/CVE-2015-4145
[4] https://security-tracker.debian.org/tracker/CVE-2015-4146

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore