CVE-2015-8605

MEDIUM

ISC DHCP <4.1-ESV-R12-P1, 4.2.x, 4.3.x <4.3.3-P1 - DoS

Title source: llm
STIX 2.1

Description

ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.

References (12)

Core 12
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034657
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-02/msg00168.html
Third Party Advisory x_refsource_confirm
https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/
Vendor Advisory x_refsource_confirm
https://kb.isc.org/article/AA-01334
Third Party Advisory x_refsource_confirm
https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175594.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3442
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2868-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176031.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/80703
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2016-02/msg00162.html

Scores

CVSS v3 6.5
EPSS 0.4344
EPSS Percentile 97.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (17)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.04
canonical/ubuntu_linux 15.10
debian/debian_linux 7.0
debian/debian_linux 8.0
debian/debian_linux 9.0
isc/dhcp 4.0.0
isc/dhcp 4.0.1
isc/dhcp 4.0.2 (2 CPE variants)
... and 7 more
Published Jan 14, 2016
Tracked Since Feb 18, 2026