CVE-2017-10984 log

Source
Severity Critical
Remote Yes
Type Arbitrary code execution
Description
A security issue has been found in freeradius <= 3.0.15, where the data2vp_wimax() function checks for WiMAX attributes which are too small, but it does not check for WiMAX attributes which are too large. As a result, the server can be convinced to read past the end of an attribute, and to write past the end of memory allocated via malloc(). A remote attacker with the ability to send packets which are accepted by the server can cause a write overflow, possibly leading to remote code execution.
Group Package Affected Fixed Severity Status Ticket
AVG-357 freeradius 3.0.14-4 3.0.15-1 Critical Fixed
Date Advisory Group Package Severity Description
18 Jul 2017 ASA-201707-23 AVG-357 freeradius Critical multiple issues
References
http://freeradius.org/security/fuzzer-2017.html#FR-GV-301
https://github.com/FreeRADIUS/freeradius-server/commit/931850e5d2f65193520c2d9c9878148c0cdc16a6