Multiple vulnerabilities have been found in dhcpcd allowing remote attackers to possibly execute arbitrary code or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/dhcpcd | * | < 6.10.0 | >= 6.10.0 |
A fully featured, yet light weight RFC2131 compliant DHCP client
A heap overflow can be triggered via malformed DHCP responses in the print_option (via dhcp_envoption1) due to incorrect option length values. These vulnerabilities could also allow remote attackers to trigger an invalid read/crash via malformed DHCP responses.
Remote attackers could possibly execute arbitrary code with the privileges of the process or cause Denial of Service.
There is no known workaround at this time.
All dhcpcd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/dhcpcd-6.10.0”
A vulnerability in dhcpcd can lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/dhcpcd | * | < 6.4.3 | >= 6.4.3 |
dhcpcd is a fully featured, yet light weight RFC2131 compliant DHCP client.
A vulnerability has been discovered in dhcpcd. A malicious dhcp server can set flags as part of the dhcp reply that can cause a Denial of Service condition.
A remote attacker can cause a Denial of Service condition.
There is no known workaround at this time.
All dhcpcd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/dhcpcd-6.4.3"
A vulnerability has been found in dhcpcd, allowing remote attackers to execute arbitrary code on the DHCP client.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/dhcpcd | * | < 5.2.12 | >= 5.2.12 |
dhcpcd is a fully featured, yet light weight RFC2131 compliant DHCP client.
A vulnerability has been discovered in dhcpcd. Please review the CVE identifier referenced below for details.
The vulnerability might allow an attacker to execute arbitrary code on the DHCP client.
There is no known workaround at this time.
All dhcpcd users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/dhcpcd-5.2.12"
A vulnerability in dhcpcd may cause the dhcpcd daemon to crash.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/dhcpcd | * | < 1.3.22_p4-r11 | >= 1.3.22_p4-r11 |
dhcpcd is a standards compliant DHCP client daemon. It requests an IP address and other information from the DHCP server, automatically configures the network interface, and tries to renew the lease time.
infamous42md discovered that dhcpcd can be tricked to read past the end of the supplied DHCP buffer. As a result, this might lead to a crash of the daemon.
With a malicious DHCP server an attacker could cause a Denial of Service by crashing the DHCP client.
There is no known workaround at this time.
All dhcpcd users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/dhcpcd-1.3.22_p4-r11"