Every CVE Search/ Get API key

CVE-2015-4143

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows...

5.0 MediumFix available

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Exploit likelihood

3.50%Up 2.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
CVE-2015-4143
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
CVE-2015-4143
Updated
2026-11-02
EUVDEUVD-2015-4167 No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
EUVD-2015-4167
Updated
2026-11-03
GitHub AdvisoriesGHSA-jrqr-5j62-r5j7 No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows...

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
GHSA-jrqr-5j62-r5j7
Weakness
CWE-119
Updated
2026-11-02
OSV No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
CVE-2015-4143
Updated
2026-11-02
OSVDEBIAN-CVE-2015-4143 No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
DEBIAN-CVE-2015-4143
Updated
2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2020:2053-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

  • CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

  • Enable SAE support (jsc#SLE-14992).
  • Limit P2P_DEVICE name to appropriate ifname size.
  • Fix wicked wlan (bsc#1156920)
  • Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
  • With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
  • Fix WLAN config on boot with wicked. (bsc#1166933)
  • Update to 2.9 release:
    • SAE changes
      • disable use of groups using Brainpool curves
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • EAP-pwd changes
      • disable use of groups using Brainpool curves
      • allow the set of groups to be configured (eap_pwd_groups)
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
    • fixed a regression in OpenSSL 1.1+ engine loading
    • added validation of RSNE in (Re)Association Response frames
    • fixed DPP bootstrapping URI parser of channel list
    • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
    • extended ca_cert_blob to support PEM format
    • improved robustness of P2P Action frame scheduling
    • added support for EAP-SIM/AKA using anonymous@realm identity
    • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
    • added experimental support for EAP-TEAP peer (RFC 7170)
    • added experimental support for EAP-TLS peer with TLS v1.3
    • fixed a regression in WMM parameter configuration for a TDLS peer
    • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
    • fixed an ECDH operation corner case with OpenSSL
    • SAE changes
      • added support for SAE Password Identifier
      • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
      • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
      • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
      • started to prefer FT-SAE over SAE AKM if both are enabled
      • started to prefer FT-SAE over FT-PSK if both are enabled
      • fixed FT-SAE when SAE PMKSA caching is used
      • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
    • EAP-pwd changes
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
      • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
      • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
      • enforce rand,mask generation rules more strictly
      • fix a memory leak in PWE derivation
      • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
      • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
    • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
    • Hotspot 2.0 changes
      • do not indicate release number that is higher than the one AP supports
      • added support for release number 3
      • enable PMF automatically for…
Record
openSUSE-SU-2020:2053-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2059-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

  • CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

  • Enable SAE support (jsc#SLE-14992).
  • Limit P2P_DEVICE name to appropriate ifname size.
  • Fix wicked wlan (bsc#1156920)
  • Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
  • With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
  • Fix WLAN config on boot with wicked. (bsc#1166933)
  • Update to 2.9 release:
    • SAE changes
      • disable use of groups using Brainpool curves
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • EAP-pwd changes
      • disable use of groups using Brainpool curves
      • allow the set of groups to be configured (eap_pwd_groups)
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
    • fixed a regression in OpenSSL 1.1+ engine loading
    • added validation of RSNE in (Re)Association Response frames
    • fixed DPP bootstrapping URI parser of channel list
    • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
    • extended ca_cert_blob to support PEM format
    • improved robustness of P2P Action frame scheduling
    • added support for EAP-SIM/AKA using anonymous@realm identity
    • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
    • added experimental support for EAP-TEAP peer (RFC 7170)
    • added experimental support for EAP-TLS peer with TLS v1.3
    • fixed a regression in WMM parameter configuration for a TDLS peer
    • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
    • fixed an ECDH operation corner case with OpenSSL
    • SAE changes
      • added support for SAE Password Identifier
      • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
      • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
      • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
      • started to prefer FT-SAE over SAE AKM if both are enabled
      • started to prefer FT-SAE over FT-PSK if both are enabled
      • fixed FT-SAE when SAE PMKSA caching is used
      • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
    • EAP-pwd changes
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
      • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
      • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
      • enforce rand,mask generation rules more strictly
      • fix a memory leak in PWE derivation
      • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
      • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
    • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
    • Hotspot 2.0 changes
      • do not indicate release number that is higher than the one AP supports
      • added support for release number 3
      • enable PMF automatically for…
Record
openSUSE-SU-2020:2059-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10022-1 No score

hostapd-2.6-1.1 on GA media

These are all security issues fixed in the hostapd-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10022-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10499-1 No score

wpa_supplicant-2.6-1.1 on GA media

These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10499-1
Updated
2026-11-02
OSVSUSE-SU-2016:2305-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

  • CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding. (bnc#930077)
  • CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing. (bnc#930078)
  • CVE-2015-4143: EAP-pwd missing payload length validation. (bnc#930079)
  • CVE-2015-5310: Ignore Key Data in WNM Sleep Mode Response frame if no PMF in use. (bsc#952254)
  • CVE-2015-8041: Fix payload length validation in NDEF record parser. (bsc#937419)
Record
SUSE-SU-2016:2305-1
Updated
2026-11-02
OSVSUSE-SU-2020:3380-1 No score

Security update for wpa_supplicant

This update for wpa_supplicant fixes the following issues:

Security issue fixed:

  • CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass (bsc#1150934).

Non-security issues fixed:

  • Enable SAE support (jsc#SLE-14992).
  • Limit P2P_DEVICE name to appropriate ifname size.
  • Fix wicked wlan (bsc#1156920)
  • Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)
  • With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)
  • Fix WLAN config on boot with wicked. (bsc#1166933)
  • Update to 2.9 release:
    • SAE changes
      • disable use of groups using Brainpool curves
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • EAP-pwd changes
      • disable use of groups using Brainpool curves
      • allow the set of groups to be configured (eap_pwd_groups)
      • improved protection against side channel attacks [https://w1.fi/security/2019-6/]
    • fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1)
    • fixed a regression in OpenSSL 1.1+ engine loading
    • added validation of RSNE in (Re)Association Response frames
    • fixed DPP bootstrapping URI parser of channel list
    • extended EAP-SIM/AKA fast re-authentication to allow use with FILS
    • extended ca_cert_blob to support PEM format
    • improved robustness of P2P Action frame scheduling
    • added support for EAP-SIM/AKA using anonymous@realm identity
    • fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method
    • added experimental support for EAP-TEAP peer (RFC 7170)
    • added experimental support for EAP-TLS peer with TLS v1.3
    • fixed a regression in WMM parameter configuration for a TDLS peer
    • fixed a regression in operation with drivers that offload 802.1X 4-way handshake
    • fixed an ECDH operation corner case with OpenSSL
    • SAE changes
      • added support for SAE Password Identifier
      • changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes
      • do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms
      • fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP
      • started to prefer FT-SAE over SAE AKM if both are enabled
      • started to prefer FT-SAE over FT-PSK if both are enabled
      • fixed FT-SAE when SAE PMKSA caching is used
      • reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256)
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868)
    • EAP-pwd changes
      • minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870)
      • verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644)
      • fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640)
      • enforce rand,mask generation rules more strictly
      • fix a memory leak in PWE derivation
      • disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27)
      • SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443)
    • fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y
    • Hotspot 2.0 changes
      • do not indicate release number that is higher than the one AP supports
      • added support for release number 3
      • enable PMF automatically for…
Record
SUSE-SU-2020:3380-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-4143 No score

The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload.

Record
UBUNTU-CVE-2015-4143
Updated
2026-11-02
OSVUSN-2650-1 No score

wpa, wpasupplicant vulnerabilities

Kostya Kortchinsky discovered multiple flaws in wpa_supplicant and hostapd. A remote attacker could use these issues to cause wpa_supplicant or hostapd to crash, resulting in a denial of service. (CVE-2015-4141, CVE-2015-4142, CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146)

Record
USN-2650-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
wpa
Debian:12
 before 2.3-2.2
2.3-2.2
wpa
Debian:13
 before 2.3-2.2
2.3-2.2
wpa
Debian:14
 before 2.3-2.2
2.3-2.2
wpa
Debian:7
From an advisory covering 11 CVEs
 before 1.0-3+deb7u3, plus listed versions
1.0-31.0-3+deb7u11.0-3+deb7u2
1.0-3+deb7u3
wpa
Debian:8
From an advisory covering 11 CVEs
 before 2.3-1+deb8u3, plus listed versions
2.3-12.3-1+deb8u12.3-1+deb8u2
2.3-1+deb8u3
wpa_supplicant
SUSE:Linux Enterprise Desktop 12 SP1
From an advisory covering 5 CVEs
 before 2.2-14.2
2.2-14.2
wpa_supplicant
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 5 CVEs
 before 2.2-14.2
2.2-14.2
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 5 CVEs
 before 2.2-14.2
2.2-14.2
wpa_supplicant
SUSE:Linux Enterprise Module for Basesystem 15 SP1
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
wpa_supplicant
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
wpa_supplicant
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
wpa_supplicant
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
wpa_supplicant
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 22 CVEs
 before 2.9-4.20.1
2.9-4.20.1
wpa
Ubuntu:14.04:LTS
 before 2.1-0ubuntu1.3, plus listed versions
1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu12.1-0ubuntu1.12.1-0ubuntu1.2
2.1-0ubuntu1.3
wpa
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
 before 2.1-0ubuntu1.3, plus listed versions
1.0-3ubuntu21.0-3ubuntu31.0-3ubuntu42.1-0ubuntu12.1-0ubuntu1.12.1-0ubuntu1.2
2.1-0ubuntu1.3
wpa_supplicant
openSUSE:Leap 15.1
From an advisory covering 22 CVEs
 before 2.9-lp151.5.10.1
2.9-lp151.5.10.1
wpa_supplicant
openSUSE:Leap 15.2
From an advisory covering 22 CVEs
 before 2.9-lp152.8.3.1
2.9-lp152.8.3.1
hostapd
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 2.6-1.1
2.6-1.1
wpa_supplicant
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 2.6-1.1
2.6-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-4143 is a medium vulnerability (CVSS 5.0) in W1.fi Hostapd, published June 1, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.50%, the 89th percentile. Fixed in wpa 2.3-2.2.

References

Show 70 moreShow less
This page doesn't list everything

Left out here: the rest of 3 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open