CVE-2015-9542
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the...
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
CVE-2015-9542- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
CVE-2015-9542- Updated
- 2026-11-02
EUVDEUVD-2015-9382 No score
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
EUVD-2015-9382- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x66h-w4xq-44q4
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the...
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
GHSA-x66h-w4xq-44q4- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
CVE-2015-9542- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-9542
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
DEBIAN-CVE-2015-9542- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2015-9542
add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.
- Record
UBUNTU-CVE-2015-9542- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0870-1 No score
Security update for pam_radius
This update for pam_radius fixes the following issues:
- CVE-2015-9542: pam_radius: buffer overflow in password field (bsc#1163933)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0870-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1896-1 No score
Security update for pam_radius
This update for pam_radius fixes the following issues:
- CVE-2015-9542: pam_radius: buffer overflow in password field (bsc#1163933)
- Record
openSUSE-SU-2021:1896-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11144-1 No score
pam_radius-2.0.0-1.3 on GA media
These are all security issues fixed in the pam_radius-2.0.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11144-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1117-1 No score
Security update for pam_radius
This update for pam_radius fixes the following issues:
- CVE-2015-9542: Fixed a buffer overflow in password field (bsc#1163933).
- On s390x didn't decrypt passwords correctly (bsc#1141670).
- Record
SUSE-SU-2020:1117-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1896-1 No score
Security update for pam_radius
This update for pam_radius fixes the following issues:
- CVE-2015-9542: pam_radius: buffer overflow in password field (bsc#1163933)
- Record
SUSE-SU-2021:1896-1- Updated
- 2026-11-02
OSVUSN-4290-1 No score
libpam-radius-auth vulnerability
It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A remote attacker could possibly use this issue to cause libpam-radius-auth to crash, resulting in a denial of service.
- Record
USN-4290-1- Updated
- 2026-11-02
OSVUSN-4290-2 No score
libpam-radius-auth vulnerability
USN-4290-1 fixed a vulnerability in libpam-radius-auth. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that libpam-radius-auth incorrectly handled certain long passwords. A remote attacker could possibly use this issue to cause libpam-radius-auth to crash, resulting in a denial of service.
- Record
USN-4290-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpam-radius-authDebian:12 |
before 1.4.0-3 | 1.4.0-3 |
libpam-radius-authDebian:13 |
before 1.4.0-3 | 1.4.0-3 |
libpam-radius-authDebian:14 |
before 1.4.0-3 | 1.4.0-3 |
libpam-radius-authDebian:8 |
before 1.3.16-4.4+deb8u1, plus listed versions 1.3.16-4.4 |
1.3.16-4.4+deb8u1 |
libpam-radius-authDebian:9 |
before 1.3.16-5+deb9u1, plus listed versions 1.3.16-5 |
1.3.16-5+deb9u1 |
pam_radiusSUSE:HPE Helion OpenStack 8 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:OpenStack Cloud 7 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:OpenStack Cloud 8 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:OpenStack Cloud Crowbar 8 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP1-LTSS |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP3-BCL |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP4 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server 12 SP5 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Enterprise Storage 5 |
before 1.3.16-239.4.1 | 1.3.16-239.4.1 |
pam_radiusSUSE:Linux Enterprise Module for Server Applications 15 SP2 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Module for Server Applications 15 SP3 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Server 15-LTSS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Server 15 SP1-BCL |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 15 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Manager Proxy 4.0 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Manager Retail Branch Server 4.0 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Manager Server 4.0 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
pam_radiusSUSE:Enterprise Storage 6 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
libpam-radius-authUbuntu:Pro:14.04:LTS |
before 1.3.17-0ubuntu4+esm1, plus listed versions 1.3.17-0ubuntu4 |
1.3.17-0ubuntu4+esm1 |
libpam-radius-authUbuntu:16.04:LTS |
before 1.3.17-0ubuntu4.1, plus listed versions 1.3.17-0ubuntu4 |
1.3.17-0ubuntu4.1 |
libpam-radius-authUbuntu:18.04:LTS |
before 1.3.17-0ubuntu5.18.04.1, plus listed versions 1.3.17-0ubuntu5 |
1.3.17-0ubuntu5.18.04.1 |
pam_radiusopenSUSE:Leap 15.2 |
before 1.4.0-lp152.4.3.1 | 1.4.0-lp152.4.3.1 |
pam_radiusopenSUSE:Leap 15.3 |
before 1.4.0-3.3.1 | 1.4.0-3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-9542 is a high vulnerability (CVSS 7.5) in Canonical Ubuntu Linux, published December 31, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.47%, the 89th percentile. Fixed in libpam-radius-auth 1.4.0-3.
References
github.com/FreeRADIUS/pam_radius/commit/01173ec2426627dbb1e0d96c06c3ffa0b14d36d0
lists.debian.org/debian-lts-announce/2020/02/msg00023.html
bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-9542
usn.ubuntu.com/4290-1
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-9542
security-tracker.debian.org/tracker/CVE-2015-9542
suse.com/support/update/announcement/2020/suse-su-20201117-1
bugzilla.suse.com/1141670
ubuntu.com/security/CVE-2015-9542
cve.org/CVERecord?id=CVE-2015-9542
lists.opensuse.org/archives/list/[email protected]/thread/3KXPRDBUQG5DRAA3TWBMKHHZP4CR2QEX