CVE-2015-9542

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary code execution might be possible, depending on the application, C library, compiler, and other factors.

• CWE-787

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-9542Issue Tracking, Patch, Third Party Advisory
• https://github.com/FreeRADIUS/pam_radius/commit/01173ec2426627dbb1e0d96c06c3ffa0b14d36d0Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/02/msg00023.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00000.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4290-1/Third Party Advisory
• https://usn.ubuntu.com/4290-2/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-9542Issue Tracking, Patch, Third Party Advisory
• https://github.com/FreeRADIUS/pam_radius/commit/01173ec2426627dbb1e0d96c06c3ffa0b14d36d0Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/02/msg00023.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00000.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4290-1/Third Party Advisory
• https://usn.ubuntu.com/4290-2/Third Party Advisory

Published

Feb 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9536The Easy Digital Downloads (EDD) Twenty-Twelve theme for Wor…6.1
• CVE-2015-9537The NextGEN Gallery plugin before 2.1.10 for WordPress has m…5.4
• CVE-2015-9538The NextGEN Gallery plugin before 2.1.15 for WordPress allow…6.5
• CVE-2015-9539The Fast Secure Contact Form plugin before 4.0.38 for WordPr…6.1
• CVE-2015-9540Chamilo LMS through 1.9.10.2 allows a link_goto.php?link_url…6.1
• CVE-2015-9541Qt through 5.14 allows an exponential XML entity expansion a…7.5
• CVE-2015-9543An issue was discovered in OpenStack Nova before 18.2.4, 19.…3.3
• CVE-2015-9544An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9545An issue was discovered in xdLocalStorage through 2.0.5. The…7.1
• CVE-2015-9546An issue was discovered on Samsung mobile devices with KK(4.…4.8
• CVE-2015-9547An issue was discovered on Samsung mobile devices with JBP(4…7.5
• CVE-2015-9548An issue was discovered in Mattermost Server before 1.2.0. I…7.5