CVE-2017-10979

CRITICAL

FreeRADIUS 2.x < 2.2.10 - Remote Code Execution via rad_coalesce() Write Overflow

Title source: llm
STIX 2.1

Description

An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1038914
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1759
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2017/dsa-3930
Patch, Vendor Advisory x_refsource_confirm
http://freeradius.org/security/fuzzer-2017.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99901

Scores

CVSS v3 9.8
EPSS 0.0704
EPSS Percentile 93.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (28)
freeradius/freeradius 2.0.0 (3 CPE variants)
freeradius/freeradius 2.0.1
freeradius/freeradius 2.0.2
freeradius/freeradius 2.0.3
freeradius/freeradius 2.0.4
freeradius/freeradius 2.0.5
freeradius/freeradius 2.1.0
freeradius/freeradius 2.1.1
freeradius/freeradius 2.1.2
freeradius/freeradius 2.1.3
... and 18 more
Published Jul 17, 2017
Tracked Since Feb 18, 2026