CVE-2016-4477

Name	CVE-2016-4477
Description	wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-473-1
Debian Bugs	823411

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wpa (PTS)	buster, buster (security)	2:2.7+git20190128+0c1e29f-6+deb10u3	fixed
	bullseye	2:2.9.0-21	fixed
	bookworm, sid	2:2.10-12	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
wpa	source	wheezy	1.0-3+deb7u4	DLA-473-1
wpa	source	jessie	2.3-1+deb8u4
wpa	source	(unstable)	2.3-2.4		823411

http://w1.fi/security/2016-1/