Every CVESearch/Get API key

CVE-2012-3547

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12,...

6.8 MediumFix available

CVE-2012-3547 is a medium vulnerability (CVSS 6.8) in Freeradius, published September 11, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.70%, the 93rd percentile. Fixed in freeradius 2.1.12+dfsg-1.1.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
5.70%EPSS, 93rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.1.12+dfsg-1.1freeradius +44 more

Description

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Exploit likelihood

5.70%Down 2.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeradius
Debian:12
before 2.1.12+dfsg-1.1
2.1.12+dfsg-1.1
freeradius
Debian:13
before 2.1.12+dfsg-1.1
2.1.12+dfsg-1.1
freeradius
Debian:14
before 2.1.12+dfsg-1.1
2.1.12+dfsg-1.1
freeradius
Debian:6.0
before 2.1.10+dfsg-2+squeeze1, plus listed versions
2.1.10+dfsg-2
2.1.10+dfsg-2+squeeze1
freeradius
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-debuginfo
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-krb5
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-ldap
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-mysql
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-perl
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
Show 35 moreShow less
Affected packages
PackageAffectedFixed
freeradius-postgresql
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-python
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-unixODBC
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-utils
Red Hat:enterprise_linux:6::server
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-debuginfo
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-krb5
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-ldap
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-mysql
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-perl
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-postgresql
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-python
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-unixODBC
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius-utils
Red Hat:enterprise_linux:6::workstation
before 0:2.1.12-4.el6_3
0:2.1.12-4.el6_3
freeradius2
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-debuginfo
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-krb5
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-ldap
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-mysql
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-perl
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-postgresql
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-python
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-unixODBC
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-utils
Red Hat:enterprise_linux:5::client_workstation
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-debuginfo
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-krb5
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-ldap
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-mysql
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-perl
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-postgresql
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-python
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-unixODBC
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius2-utils
Red Hat:enterprise_linux:5::server
before 0:2.1.12-4.el5_8
0:2.1.12-4.el5_8
freeradius-server
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
before 3.0.12-1.1
3.0.12-1.1

What each source reports

NVD Score used6.8

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
CVE-2012-3547
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
CVE-2012-3547
Updated
2026-11-02
EUVDEUVD-2012-3494No score

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
EUVD-2012-3494
Updated
2026-11-03
GitHub AdvisoriesGHSA-rv5x-2jxm-gf9cNo score

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12,...

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
GHSA-rv5x-2jxm-gf9c
Weakness
CWE-119
Updated
2026-11-02
OSVNo score

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
CVE-2012-3547
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3547No score

Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.

Record
DEBIAN-CVE-2012-3547
Updated
2026-11-02
OSVopenSUSE-SU-2024:10053-1No score

freeradius-server-3.0.12-1.1 on GA media

These are all security issues fixed in the freeradius-server-3.0.12-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10053-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 27 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open