{"id":"CVE-2014-8322","aliases":["DEBIAN-CVE-2014-8322","EUVD-2014-8163","GHSA-3548-7j56-4648","MGASA-2015-0035"],"status":"published","title":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2...","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.23925,"percentile":0.97848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-787"],"published":"2015-01-24T14:32:04Z","modified":"2026-10-23T16:01:43Z","exploits":[{"source":"exploitdb","id":"EDB-35018","title":"Aireplay-ng 1.2 beta3 - 'tcp_test' Length Stack Overflow","type":"remote","platform":"linux","date":"2014-10-20","url":"https://www.exploit-db.com/exploits/35018"}],"fixes":[{"ecosystem":"Debian:12","package":"aircrack-ng","fixed_in":["1:1.2-0~beta3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aircrack-ng","fixed_in":["1:1.2-0~beta3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aircrack-ng","fixed_in":["1:1.2-0~beta3-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"aircrack-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2-0~beta3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"aircrack-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2-0~beta3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"aircrack-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.2-0~beta3-2"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"aircrack-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-7.2.mga4"}]}],"bundled":3}],"products":[{"vendor":"aircrack-ng","product":"aircrack-ng"}],"references":[{"url":"http://aircrack-ng.blogspot.com/2014/10/aircrack-ng-12-release-candidate-1.html","tags":["x_refsource_CONFIRM","x_transferred","Product","Release Notes","Third Party Advisory","advisory","article"]},{"url":"http://packetstormsecurity.com/files/128943/Aircrack-ng-1.2-Beta-3-DoS-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/aircrack-ng/aircrack-ng/commit/091b153f294b9b695b0b2831e65936438b550d7b","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.exploit-db.com/exploits/35018","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/aircrack-ng/aircrack-ng/pull/14","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98459","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8322"},{"url":"https://github.com/advisories/GHSA-3548-7j56-4648"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8322","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0035.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14557","tags":["report"]},{"url":"https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1401/","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-November/143595.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8322","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2020-01-31T21:21:25Z","modified":"2024-08-06T13:10:51.183Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-8163","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2020-01-31T21:21:25Z","modified":"2024-08-06T13:10:51Z","updated_at":"2026-11-03T01:56:52.443165Z"}],"ghsa":[{"id":"GHSA-3548-7j56-4648","title":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2...","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2022-05-17T19:57:23Z","modified":"2023-01-28T05:04:40Z","updated_at":"2026-11-02T14:44:13.169568Z"}],"nvd":[{"id":"CVE-2014-8322","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2020-01-31T22:15:11.057Z","modified":"2026-06-17T00:16:33.297Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:02:59.461996Z"}],"osv":[{"id":"CVE-2014-8322","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2020-01-31T22:15:11Z","modified":"2026-04-16T06:22:45.71893878Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-8322","description":"Stack-based buffer overflow in the tcp_test function in aireplay-ng.c in Aircrack-ng before 1.2 RC 1 allows remote attackers to execute arbitrary code via a crafted length parameter value.","status":"published","published":"2020-01-31T22:15:11.057Z","modified":"2026-10-23T16:01:43.494712647Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0035","title":"Updated aircrack-ng packages fix security vulnerabilities","description":"Updated aircrack-ng package fixes security vulnerabilities:\n\nA length parameter inconsistency in Aircrack-ng before 1.2-rc1 at aireplay\ntcp_test() which may lead to remote code execution (CVE-2014-8322).\n\nA missing check for data format in Aircrack-ng before 1.2-rc1 at buddy-ng\nwhich may lead to denial of service (CVE-2014-8323).\n\nA missing check for invalid values in Aircrack-ng before 1.2-rc1 at airserv-ng\nnet_get() which may lead to denial of service (CVE-2014-8324).\n","status":"published","published":"2015-01-24T14:32:04Z","modified":"2026-04-16T06:24:28.571801551Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}