CVE-2015-3310
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4...
CVE-2015-3310 is a medium vulnerability (CVSS 4.3) in Canonical Ubuntu Linux, published April 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.41%, the 92nd percentile. Fixed in ppp 2.5.0-1.
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
CVE-2015-3310- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
CVE-2015-3310- Updated
- 2026-11-02
EUVDEUVD-2015-3356 No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
EUVD-2015-3356- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fm2f-v6g4-x3jw No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4...
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
GHSA-fm2f-v6g4-x3jw- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVAZL-44211 No score
CVE-2015-3310 affecting package ppp for versions less than 2.5.0-1
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
AZL-44211- Updated
- 2026-11-02
OSV No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
CVE-2015-3310- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2015-3310 No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
DEBIAN-CVE-2015-3310- Updated
- 2026-11-02
OSVMGASA-2015-0173 No score
Updated ppp packages fix CVE-2015-3310
Updated ppp packages fix security vulnerability:
Emanuele Rocca discovered that ppp was subject to a buffer overflow when communicating with a RADIUS server. This would allow unauthenticated users to cause a denial-of-service by crashing the daemon (CVE-2015-3310).
- Record
MGASA-2015-0173- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10049-1 No score
ppp-2.4.7-7.1 on GA media
These are all security issues fixed in the ppp-2.4.7-7.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10049-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0473-1 No score
Security update for ppp
The ppp package was updated to fix the following security issue:
- CVE-2015-3310: Fixed a buffer overflow in radius plug-in's rc_mksid() (bsc#927841).
- Record
SUSE-SU-2017:0473-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0474-1 No score
Security update for ppp
The ppp package was updated to fix the following security issue:
- CVE-2015-3310: Fixed a buffer overflow in radius plug-in's rc_mksid() (bsc#927841).
- Record
SUSE-SU-2017:0474-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3310 No score
Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial of service (crash) via a start accounting message to the RADIUS server.
- Record
UBUNTU-CVE-2015-3310- Updated
- 2026-11-02
OSVUSN-2595-1 No score
ppp vulnerability
It was discovered that ppp incorrectly handled large PIDs. When pppd is used with a RADIUS server, a remote attacker could use this issue to cause it to crash, resulting in a denial of service.
- Record
USN-2595-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pppAzure Linux:3 |
before 2.5.0-1 | 2.5.0-1 |
pppDebian:12 |
before 2.4.6-3.1 | 2.4.6-3.1 |
pppDebian:13 |
before 2.4.6-3.1 | 2.4.6-3.1 |
pppDebian:14 |
before 2.4.6-3.1 | 2.4.6-3.1 |
pppDebian:6.0 |
before 2.4.5-4+deb6u2, plus listed versions 2.4.5-4 |
2.4.5-4+deb6u2 |
pppDebian:7 |
before 2.4.5-5.1+deb7u2, plus listed versions 2.4.5-5.12.4.5-5.1+deb7u1 |
2.4.5-5.1+deb7u2 |
pppMageia:4 |
before 2.4.5-17.2.mga4 | 2.4.5-17.2.mga4 |
pppSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.4.5.git-2.31.7 | 2.4.5.git-2.31.7 |
pppSUSE:Linux Enterprise Server 11 SP4 |
before 2.4.5.git-2.31.7 | 2.4.5.git-2.31.7 |
pppSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 2.4.5.git-2.31.7 | 2.4.5.git-2.31.7 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pppSUSE:Linux Enterprise Desktop 12 SP1 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Desktop 12 SP2 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Server 12 SP1 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Server 12 SP2 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 2.4.7-3.4 | 2.4.7-3.4 |
pppUbuntu:14.04:LTS |
before 2.4.5-5.1ubuntu2.2, plus listed versions 2.4.5-5.1ubuntu22.4.5-5.1ubuntu2.1 |
2.4.5-5.1ubuntu2.2 |
pppopenSUSE:Tumbleweed |
before 2.4.7-7.1 | 2.4.7-7.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=782450
mandriva.com/security/advisories?name=MDVSA-2015:222
debian.org/security/2015/dsa-3228
ubuntu.com/usn/USN-2595-1
securityfocus.com/bid/74163
security.gentoo.org/glsa/201701-50
Show 15 moreShow less
advisories.mageia.org/MGASA-2015-0173.html
lists.opensuse.org/opensuse-updates/2015-11/msg00147.html
nvd.nist.gov/vuln/detail/CVE-2015-3310
github.com/advisories/GHSA-fm2f-v6g4-x3jw
security-tracker.debian.org/tracker/CVE-2015-3310
bugs.mageia.org/show_bug.cgi?id=15714
suse.com/support/update/announcement/2017/suse-su-20170473-1
bugzilla.suse.com/927841
ubuntu.com/security/CVE-2015-3310
openwall.com/lists/oss-security/2015/04/13/4
cve.org/CVERecord?id=CVE-2015-3310