CVE-2007-2831

Array index error in the (1) ieee80211_ioctl_getwmmparams and (2) ieee80211_ioctl_setwmmparams functions in net80211/ieee80211_wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service (system crash), possibly obtain kernel memory contents, and possibly execute arbitrary code via a large negative array index value.

• CWE-119

• http://madwifi.org/ticket/1334Patch
• http://madwifi.org/wiki/SecurityPatch
• http://osvdb.org/36637
• http://secunia.com/advisories/25339Vendor Advisory
• http://secunia.com/advisories/25622Vendor Advisory
• http://secunia.com/advisories/25763Vendor Advisory
• http://secunia.com/advisories/25861Vendor Advisory
• http://secunia.com/advisories/26083Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200706-04.xml
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:132
• http://www.novell.com/linux/security/advisories/2007_14_sr.html
• http://www.securityfocus.com/archive/1/470674/100/100/threaded
• http://www.securityfocus.com/bid/24114
• http://www.ubuntu.com/usn/usn-479-1
• http://www.vupen.com/english/advisories/2007/1919
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34453
• http://madwifi.org/ticket/1334Patch
• http://madwifi.org/wiki/SecurityPatch
• http://osvdb.org/36637
• http://secunia.com/advisories/25339Vendor Advisory
• http://secunia.com/advisories/25622Vendor Advisory
• http://secunia.com/advisories/25763Vendor Advisory
• http://secunia.com/advisories/25861Vendor Advisory
• http://secunia.com/advisories/26083Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200706-04.xml
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:132
• http://www.novell.com/linux/security/advisories/2007_14_sr.html
• http://www.securityfocus.com/archive/1/470674/100/100/threaded
• http://www.securityfocus.com/bid/24114
• http://www.ubuntu.com/usn/usn-479-1
• http://www.vupen.com/english/advisories/2007/1919
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34453

Published

May 24, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-2825Multiple cross-site scripting (XSS) vulnerabilities in ReadM…
• CVE-2007-2826PHP remote file inclusion vulnerability in lib/addressbook.p…
• CVE-2007-2827Heap-based buffer overflow in LEAD Technologies LEADTOOLS IS…
• CVE-2007-2828Cross-site request forgery (CSRF) vulnerability in adsense-d…
• CVE-2007-2829The 802.11 network stack in net80211/ieee80211_input.c in Ma…
• CVE-2007-2830The ath_beacon_config function in if_ath.c in MadWifi before…
• CVE-2007-2832Cross-site scripting (XSS) vulnerability in the web applicat…
• CVE-2007-2833Emacs 21 allows user-assisted attackers to cause a denial of…
• CVE-2007-2834Integer overflow in the TIFF parser in OpenOffice.org (OOo) …
• CVE-2007-2835Multiple stack-based buffer overflows in (1) CCE_pinyin.c an…
• CVE-2007-2836Directory traversal vulnerability in session.rb in Hiki 0.8.…
• CVE-2007-2837The (1) getRule and (2) getChains functions in server/rules.…