{"id":"CVE-2016-4477","aliases":["ALPINE-CVE-2016-4477","DEBIAN-CVE-2016-4477","DLA-473-1","EUVD-2016-5464","GHSA-3wj5-xm6v-9hmq","MGASA-2016-0199","UBUNTU-CVE-2016-4477","USN-3455-1","openSUSE-SU-2024:10499-1"],"status":"published","title":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters,...","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00255,"percentile":0.17217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19"],"published":"2016-05-09T00:00:00Z","modified":"2026-09-22T07:01:04Z","fixes":[{"ecosystem":"Alpine:v3.4","package":"wpa_supplicant","fixed_in":["2.5-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wpa","fixed_in":["2.1-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wpa","fixed_in":["2.4-0ubuntu6.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wpa","fixed_in":["2.4-0ubuntu10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-3+deb7u4"}]}],"versions":["1.0-3","1.0-3+deb7u1","1.0-3+deb7u2","1.0-3+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-3.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.5"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu6.2"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu10"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.5"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu6.2"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1.1"}]}],"bundled":13}],"products":[{"vendor":"google","product":"android"}],"references":[{"url":"http://source.android.com/security/bulletin/2016-05-01.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/03/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-3455-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4477"},{"url":"https://github.com/advisories/GHSA-3wj5-xm6v-9hmq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-4477","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4477","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18335","tags":["report"]},{"url":"http://w1.fi/security/2016-1/psk-parameter-config-update.txt","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2016-4477","tags":["report"]},{"url":"http://w1.fi/security/2016-1/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3455-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13088","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4477","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:00:00Z","modified":"2024-08-06T00:32:25.462Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-5464","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:46.329763Z"}],"ghsa":[{"id":"GHSA-3wj5-xm6v-9hmq","title":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters,...","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2022-05-17T00:32:02Z","modified":"2023-02-03T05:01:50Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:53:03.296613Z"}],"nvd":[{"id":"CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:59:42.987Z","modified":"2026-06-17T00:47:37.943Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"ALPINE-CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:59:42.987Z","modified":"2026-09-22T06:30:20.47336991Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:59:42.987Z","modified":"2026-04-16T06:19:05.95420865Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T10:59:42.987Z","modified":"2026-09-22T07:01:04.384278603Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4477","description":"wpa_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.","status":"published","published":"2016-05-09T00:00:00Z","modified":"2026-02-04T03:14:54.159338Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-473-1","title":"wpa - security update","status":"published","published":"2016-05-14T00:00:00Z","modified":"2026-03-09T02:09:31.947488Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0199","title":"Updated wpa_supplicant packages fix security vulnerabilities","description":"Updated wpa_suppliant packages fix security vulnerabilities:\n\nA vulnerability was found in how wpa_supplicant writes the configuration file\nupdate for the WPA/WPA2 passphrase parameter. If this parameter has been\nupdated to include control characters either through a WPS operation\n(CVE-2016-4476) or through local configuration change over the wpa_supplicant\ncontrol interface (CVE-2016-4477), the resulting configuration file may prevent\nthe wpa_supplicant from starting when the updated file is used. In addition, it\nmay be possible to load a local library file and execute code from there with\nthe same privileges under which the wpa_supplicant process runs.\n","status":"published","published":"2016-05-21T22:11:24Z","modified":"2026-04-16T06:24:10.188206983Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10499-1","title":"wpa_supplicant-2.6-1.1 on GA media","description":"These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:03.526024Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-3455-1","title":"wpa vulnerabilities","description":"Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly\nhandled WPA2. A remote attacker could use this issue with key\nreinstallation attacks to obtain sensitive information. (CVE-2017-13077,\nCVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081,\nCVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)\n\nImre Rad discovered that wpa_supplicant and hostapd incorrectly handled\ninvalid characters in passphrase parameters. A remote attacker could use\nthis issue to cause a denial of service. (CVE-2016-4476)\n\nImre Rad discovered that wpa_supplicant and hostapd incorrectly handled\ninvalid characters in passphrase parameters. A local attacker could use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-4477)\n","status":"published","published":"2017-10-16T15:39:35Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}