Skip to content
OpenAdvisories
Unscored USN-2650-1 6 CVEs

wpa, wpasupplicant vulnerabilities

Published Jun 16, 2015 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Kostya Kortchinsky discovered multiple flaws in wpa_supplicant and hostapd.
A remote attacker could use these issues to cause wpa_supplicant or hostapd
to crash, resulting in a denial of service. (CVE-2015-4141, CVE-2015-4142,
CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS wpa 2.1-0ubuntu1.3

Vulnerabilities 6

  • Unscored —
    CVE-2015-4141

    The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 …

    wpa wpa Debian Ubuntu
  • Unscored —
    CVE-2015-4142

    Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, whe…

    wpa wpa Debian Ubuntu
  • Unscored —
    CVE-2015-4143

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cau…

    wpa wpa Debian Ubuntu
  • Unscored —
    CVE-2015-4144

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a messa…

    wpa wpa Debian Ubuntu
  • Unscored —
    CVE-2015-4145

    The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment i…

    wpa wpa Debian Ubuntu
  • Unscored —
    CVE-2015-4146

    The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More…

    wpa wpa Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-4141
  • report
    https://ubuntu.com/security/CVE-2015-4142
  • report
    https://ubuntu.com/security/CVE-2015-4143
  • report
    https://ubuntu.com/security/CVE-2015-4144
  • report
    https://ubuntu.com/security/CVE-2015-4145
  • report
    https://ubuntu.com/security/CVE-2015-4146