Every CVE Search/ Get API key

CVE-2017-10982

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in...

7.5 HighFix available

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

3.84%Up 2.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
CVE-2017-10982
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
CVE-2017-10982
Updated
2026-11-02
EUVDEUVD-2017-2620 No score

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
EUVD-2017-2620
Updated
2026-11-03
GitHub AdvisoriesGHSA-ffpm-3vr6-89rp 7.5

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in...

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
GHSA-ffpm-3vr6-89rp
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 7.5

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
CVE-2017-10982
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-10982 7.5

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
DEBIAN-CVE-2017-10982
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2017:1759 8.1

Red Hat Security Advisory: freeradius security update

Record
RHSA-2017:1759
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-10982 7.5

An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.

Record
UBUNTU-CVE-2017-10982
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2017-0232 No score

Updated freeradius packages fix security vulnerabilities

Fuzz testing of freeradius found multiple vulnerabilites that resulted in either the potential for remote code execution or a possible denial of service (except for CVE-2017-10988 which was later determined to not actually result in any vulnerability).

Record
MGASA-2017-0232
Updated
2026-11-02
OSVSUSE-SU-2017:2244-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2017-10981: DHCP - Fix memory leak in fr_dhcp_decode(). (bnc#1049086)
  • CVE-2017-10982: Fix buffer over-read in fr_dhcp_decode_options(). (bsc#1049086)
  • CVE-2017-10983: Fix read overflow when decoding option 63. (bnc#1049086)
  • CVE-2017-10978: Fix read / write overflow in make_secret(). (bnc#1049086)
  • CVE-2017-10979: Fix write overflow in rad_coalesce(). (bsc#1049086)
Record
SUSE-SU-2017:2244-1
Updated
2026-11-02
OSVUSN-3369-1 No score

freeradius vulnerabilities

Guido Vranken discovered that FreeRADIUS incorrectly handled memory when decoding packets. A remote attacker could use this issue to cause FreeRADIUS to crash or hang, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-3369-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeradius
Debian:12
 before 3.0.12+dfsg-3
3.0.12+dfsg-3
freeradius
Debian:13
 before 3.0.12+dfsg-3
3.0.12+dfsg-3
freeradius
Debian:14
 before 3.0.12+dfsg-3
3.0.12+dfsg-3
freeradius
Debian:7
From an advisory covering 6 CVEs
 before 2.1.12+dfsg-1.2+deb7u2, plus listed versions
2.1.12+dfsg-1.22.1.12+dfsg-1.2+deb7u1
2.1.12+dfsg-1.2+deb7u2
freeradius
Mageia:5
From an advisory covering 11 CVEs
 before 2.2.10-1.mga5
2.2.10-1.mga5
freeradius
Mageia:6
From an advisory covering 11 CVEs
 before 3.0.15-1.mga6
3.0.15-1.mga6
freeradius
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-krb5
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-ldap
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
Show 23 moreShow less
Affected packages
PackageAffectedFixed
freeradius-mysql
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-perl
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-postgresql
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-python
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-unixODBC
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-utils
Red Hat:enterprise_linux:6::server
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-krb5
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-ldap
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-mysql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-perl
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-postgresql
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-python
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-unixODBC
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-utils
Red Hat:enterprise_linux:6::workstation
From an advisory covering 6 CVEs
 before 0:2.2.6-7.el6_9
0:2.2.6-7.el6_9
freeradius-server
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 5 CVEs
 before 2.1.1-7.25.3.1
2.1.1-7.25.3.1
freeradius-server
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 5 CVEs
 before 2.1.1-7.25.3.1
2.1.1-7.25.3.1
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 5 CVEs
 before 2.1.1-7.25.3.1
2.1.1-7.25.3.1
freeradius
Ubuntu:14.04:LTS
 before 2.1.12+dfsg-1.2ubuntu8.2, plus listed versions
2.1.12+dfsg-1.2ubuntu52.1.12+dfsg-1.2ubuntu62.1.12+dfsg-1.2ubuntu72.1.12+dfsg-1.2ubuntu82.1.12+dfsg-1.2ubuntu8.1
2.1.12+dfsg-1.2ubuntu8.2
freeradius
Ubuntu:16.04:LTS
 before 2.2.8+dfsg-0.1ubuntu0.1, plus listed versions
2.1.12+dfsg-1.3ubuntu52.2.8+dfsg-0.12.2.8+dfsg-0.1build12.2.8+dfsg-0.1build2
2.2.8+dfsg-0.1ubuntu0.1
freeradius
Ubuntu:14.04:LTS
From an advisory covering 6 CVEs
 before 2.1.12+dfsg-1.2ubuntu8.2, plus listed versions
2.1.12+dfsg-1.2ubuntu52.1.12+dfsg-1.2ubuntu62.1.12+dfsg-1.2ubuntu72.1.12+dfsg-1.2ubuntu82.1.12+dfsg-1.2ubuntu8.1
2.1.12+dfsg-1.2ubuntu8.2
freeradius
Ubuntu:16.04:LTS
From an advisory covering 6 CVEs
 before 2.2.8+dfsg-0.1ubuntu0.1, plus listed versions
2.1.12+dfsg-1.3ubuntu52.2.8+dfsg-0.12.2.8+dfsg-0.1build12.2.8+dfsg-0.1build2
2.2.8+dfsg-0.1ubuntu0.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-10982 is a high vulnerability (CVSS 7.5) in Freeradius, published July 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.84%, the 90th percentile. Fixed in freeradius 3.0.12+dfsg-3.

References

Show 48 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open