The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_supplicant 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when EAP-pwd is enabled in a network configuration profile, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.
Base Score: 4.3
Impact Score: 2.9
Exploitability Score: 8.6
Base Score: 5.9
Impact Score: 3.6
Exploitability Score: 2.2
|90568||FreeBSD : hostapd and wpa_supplicant -- multiple vulnerabilities (976567f6-05c5-11e6-94fa-002590263bf5)||Nessus||FreeBSD Local Security Checks|
|86848||Ubuntu 14.04 LTS / 15.04 / 15.10 : wpa vulnerabilities (USN-2808-1)||Nessus||Ubuntu Local Security Checks|
|86833||Debian DSA-3397-1 : wpa - security update||Nessus||Debian Local Security Checks|