Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by PPP Project

    CVE-2026-75883 (GCVE-0-2026-75883)

    Vulnerability from nvd – Published: 2026-09-18 15:29 – Updated: 2026-09-18 15:29
    VLAI
    Title
    PPPD buffer overflow in PEAP response code
    Summary
    The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    PPP Project ppp Affected: 0 , ≤ 2.5.0 (semver)
    Unaffected: 2.5.4 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ppp",
          "repo": "https://github.com/interchange/interchange/",
          "vendor": "PPP Project",
          "versions": [
            {
              "lessThanOrEqual": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.5.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The code in \u003ccode\u003epppd\u003c/code\u003e that formats a response to a PEAP Request packet in \u003ccode\u003epeap_response()\u003c/code\u003e copies an entire TLS record of up to 16384 bytes into the fixed global buffer \u003ccode\u003eoutpacket_buf\u003c/code\u003e\n without checking the available space and without implementing outgoing \nPEAP fragmentation. Thus a pppd process connecting to a server which \nrequests PEAP authentication can be induced to corrupt global static \ndata following the \u003ccode\u003eoutpacket_buf\u003c/code\u003e array, most likely causing incorrect behavior or a crash."
            }
          ],
          "value": "The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf\n without checking the available space and without implementing outgoing \nPEAP fragmentation. Thus a pppd process connecting to a server which \nrequests PEAP authentication can be induced to corrupt global static \ndata following the outpacket_buf array, most likely causing incorrect behavior or a crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T15:29:07.702Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PPPD buffer overflow in PEAP response code",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-75883",
    "datePublished": "2026-09-18T15:29:07.702Z",
    "dateReserved": "2026-08-18T13:09:30.492Z",
    "dateUpdated": "2026-09-18T15:29:07.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-75883 (GCVE-0-2026-75883)

    Vulnerability from cvelistv5 – Published: 2026-09-18 15:29 – Updated: 2026-09-18 15:29
    VLAI
    Title
    PPPD buffer overflow in PEAP response code
    Summary
    The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf without checking the available space and without implementing outgoing PEAP fragmentation. Thus a pppd process connecting to a server which requests PEAP authentication can be induced to corrupt global static data following the outpacket_buf array, most likely causing incorrect behavior or a crash.
    Severity
    6.8 (Medium)
    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    CWE
    • CWE-122 - Heap-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    PPP Project ppp Affected: 0 , ≤ 2.5.0 (semver)
    Unaffected: 2.5.4 (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "ppp",
          "repo": "https://github.com/interchange/interchange/",
          "vendor": "PPP Project",
          "versions": [
            {
              "lessThanOrEqual": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.5.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The code in \u003ccode\u003epppd\u003c/code\u003e that formats a response to a PEAP Request packet in \u003ccode\u003epeap_response()\u003c/code\u003e copies an entire TLS record of up to 16384 bytes into the fixed global buffer \u003ccode\u003eoutpacket_buf\u003c/code\u003e\n without checking the available space and without implementing outgoing \nPEAP fragmentation. Thus a pppd process connecting to a server which \nrequests PEAP authentication can be induced to corrupt global static \ndata following the \u003ccode\u003eoutpacket_buf\u003c/code\u003e array, most likely causing incorrect behavior or a crash."
            }
          ],
          "value": "The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into the fixed global buffer outpacket_buf\n without checking the available space and without implementing outgoing \nPEAP fragmentation. Thus a pppd process connecting to a server which \nrequests PEAP authentication can be induced to corrupt global static \ndata following the outpacket_buf array, most likely causing incorrect behavior or a crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T15:29:07.702Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "PPPD buffer overflow in PEAP response code",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-75883",
    "datePublished": "2026-09-18T15:29:07.702Z",
    "dateReserved": "2026-08-18T13:09:30.492Z",
    "dateUpdated": "2026-09-18T15:29:07.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}