CVE-2015-4142

Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.

Published: 2015-06-15 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2015-4142 is rated Moderate Risk (45.7/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 4.21%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2015-4142

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 7.07% 4.21% -2.86%
2 2025-06-21 3.85% 7.07% +3.22%
3 2025-05-28 3.85%

Full EPSS history (15 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2015-4142

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
8.6 2.9 [email protected]

Weakness enumeration for CVE-2015-4142

OS Trackers for CVE-2015-4142

vendor priority summary link
debian not yet assigned CVE-2015-4142 not yet assigned priority: Debian including 1 source packages (wpa), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2015-4142
gentoo normal CVE-2015-4142: 1 GLSA(s) (201606-17), 2 atom(s) (net-wireless/hostapd, net-wireless/wpa_supplicant); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2015-4142
redhat low https://access.redhat.com/security/cve/CVE-2015-4142
suse medium CVE-2015-4142 severity moderate: SUSE including 29 source package names (hostapd-2.6-1.1, latest:wpa_supplicant-2.9-4.20.1, …), 91 product×package rows across 82 product lines (Container rancher/elemental-teal-rt/5.3, Container rancher/elemental-teal-rt/5.4, … (82 product lines)): Fixed 78, Known Not Affected 13. https://www.suse.com/security/cve/CVE-2015-4142/
ubuntu medium CVE-2015-4142 medium priority: Ubuntu including 3 source packages (hostapd, wpa, wpasupplicant), 27 status rows across 9 suites (precise, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 15, released 8, pending 3, ignored 1. https://ubuntu.com/security/CVE-2015-4142

Affected software / configurations for CVE-2015-4142

Vendor Product Version Raw CPE
w1.fi wpa_supplicant 0.7.0 cpe:2.3:a:w1.fi:wpa_supplicant:0.7.0:*:*:*:*:*:*:*
w1.fi wpa_supplicant 0.7.1 cpe:2.3:a:w1.fi:wpa_supplicant:0.7.1:*:*:*:*:*:*:*
w1.fi wpa_supplicant 0.7.2 cpe:2.3:a:w1.fi:wpa_supplicant:0.7.2:*:*:*:*:*:*:*
w1.fi wpa_supplicant 0.7.3 cpe:2.3:a:w1.fi:wpa_supplicant:0.7.3:*:*:*:*:*:*:*
w1.fi wpa_supplicant 1.0 cpe:2.3:a:w1.fi:wpa_supplicant:1.0:*:*:*:*:*:*:*
w1.fi wpa_supplicant 1.1 cpe:2.3:a:w1.fi:wpa_supplicant:1.1:*:*:*:*:*:*:*
w1.fi wpa_supplicant 2.0 cpe:2.3:a:w1.fi:wpa_supplicant:2.0:*:*:*:*:*:*:*
w1.fi wpa_supplicant 2.1 cpe:2.3:a:w1.fi:wpa_supplicant:2.1:*:*:*:*:*:*:*
w1.fi wpa_supplicant 2.2 cpe:2.3:a:w1.fi:wpa_supplicant:2.2:*:*:*:*:*:*:*
w1.fi wpa_supplicant 2.3 cpe:2.3:a:w1.fi:wpa_supplicant:2.3:*:*:*:*:*:*:*
w1.fi wpa_supplicant 2.4 cpe:2.3:a:w1.fi:wpa_supplicant:2.4:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_hpc_node 6.0 cpe:2.3:o:redhat:enterprise_linux_hpc_node:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
w1.fi hostapd 0.7.0 cpe:2.3:a:w1.fi:hostapd:0.7.0:*:*:*:*:*:*:*
w1.fi hostapd 0.7.1 cpe:2.3:a:w1.fi:hostapd:0.7.1:*:*:*:*:*:*:*
w1.fi hostapd 0.7.2 cpe:2.3:a:w1.fi:hostapd:0.7.2:*:*:*:*:*:*:*
w1.fi hostapd 0.7.3 cpe:2.3:a:w1.fi:hostapd:0.7.3:*:*:*:*:*:*:*
w1.fi hostapd 1.0 cpe:2.3:a:w1.fi:hostapd:1.0:*:*:*:*:*:*:*
w1.fi hostapd 1.1 cpe:2.3:a:w1.fi:hostapd:1.1:*:*:*:*:*:*:*
w1.fi hostapd 2.0 cpe:2.3:a:w1.fi:hostapd:2.0:*:*:*:*:*:*:*
w1.fi hostapd 2.1 cpe:2.3:a:w1.fi:hostapd:2.1:*:*:*:*:*:*:*
w1.fi hostapd 2.2 cpe:2.3:a:w1.fi:hostapd:2.2:*:*:*:*:*:*:*
w1.fi hostapd 2.3 cpe:2.3:a:w1.fi:hostapd:2.3:*:*:*:*:*:*:*
w1.fi hostapd 2.4 cpe:2.3:a:w1.fi:hostapd:2.4:*:*:*:*:*:*:*
opensuse opensuse 13.1 cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuse opensuse 13.2 cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*

References for CVE-2015-4142

URL Tags
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171401.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172608.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172655.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00019.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1090.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1439.html
http://seclists.org/fulldisclosure/2022/May/34
http://w1.fi/security/2015-3/integer-underflow-in-ap-mode-wmm-action-frame.txt Vendor Advisory
http://www.debian.org/security/2015/dsa-3397
http://www.openwall.com/lists/oss-security/2015/05/09/5
http://www.openwall.com/lists/oss-security/2015/05/31/6
http://www.securitytracker.com/id/1032625
http://www.ubuntu.com/usn/USN-2650-1
https://security.gentoo.org/glsa/201606-17 Third Party Advisory
https://support.apple.com/kb/HT213258
cvelogic Threat Intelligence