CVE-2014-3686
Fixed in a distro release EPSS 5%
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.
Products: w1.fi hostapd, w1.fi wpa_supplicant, canonical ubuntu_linux, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | wpa | 2.3-1 |
| Debian 13 | wpa | 2.3-1 |
| Debian 14 | wpa | 2.3-1 |
| Debian 6.0 | wpasupplicant | 0.6.10-2.1+deb6u1 |
| Debian 7 | wpa | 1.0-3+deb7u1 |
| Red Hat Enterprise Linux 7 | wpa_supplicant | 1:2.0-13.el7_0 |
| Red Hat Enterprise Linux 7 | wpa_supplicant-debuginfo | 1:2.0-13.el7_0 |
| SUSE Linux Enterprise Desktop 12 | wpa_supplicant | 2.2-8.1 |
| SUSE Linux Enterprise Server 12 | wpa_supplicant | 2.2-8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | wpa_supplicant | 2.2-8.1 |
| Ubuntu 14.04 LTS | wpa | 2.1-0ubuntu1.1 |
| openSUSE Tumbleweed | hostapd | 2.6-1.1 |
| openSUSE Tumbleweed | wpa_supplicant | 2.6-1.1 |